Cookies and Computer Security

Cookies are small text files that a website stores on your computer. They remember things about you, like your preferences or your login session. Cookies make websites easier to use. Managed badly, they’re a risk.

One risk is that cookies can hold private data, such as session tokens or personal details. If that cookie isn’t protected, attackers can steal it. That’s why websites should use HTTPS and set the “secure” flag on any cookie that holds login or personal data.
Cookies also track what you do online. Advertisers use them this way all the time, and the same tracking can be used to build a detailed profile of your interests and habits that gets sold to third parties or used to target you with malicious content you never asked to see.

You can take a few precautions. Disable cookies in your browser settings, though some sites will break. Or use private browsing.

Browser extensions can also help you manage cookies. You can block or delete cookies from specific sites, or block all cookies except those from sites you trust. Some extensions block tracking cookies or third-party cookies specifically.

A virtual private network (VPN) encrypts your internet connection, which protects cookies from being intercepted on public Wi-Fi. It won’t stop a website from setting cookies. Browse carefully anyway.

Websites have a job to do too. They should use secure connections and set the “secure” flag on cookies that hold private data. They should also prevent cross-site scripting (XSS) attacks, where an attacker injects malicious code into a site and steals cookies.

Cookies make browsing easier, but they need managing. Block third-party cookies, clear the rest now and then, and use a VPN on untrusted networks. Websites should do their part with HTTPS and XSS protection.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.