What's the point of rejecting a cookie?

Question

When you access a website, lynx provide the option to reject a cookie, what's the point of doing so?

All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS attack, is that everything?

Answer 1

Cookies can be used to keep you logged in to a website, track your browsing history, log your activity and preferences on a website, and some other things. Rejecting cookies prevents this information from being tracked and easily available to the site owner or third-party affiliates. It will also, of course, prevent attackers from accessing or abusing the data through a number of means such as XSS, CRSF, DNS cache poisoning, traffic sniffing, local system exploitation, etc.

I suggest you read more about HTTP Cookies on Wikipedia, and search the web for further details as well. The following sections of the Wiki entry will probably be of particular interest to you:

• Uses
• Privacy and third-party cookies
• Cookie theft and session hijacking

There are some down-sides to rejecting some cookies.

• Your authentication to a website will not persist across sessions - you will have to log in again every visit.
• Your preferences on a website may not be saved, or may not be available until you login.
• You may not be able to use a shopping cart on e-commerce websites.
• Other site features that rely on cookies will not function.

Just like any security measure, the choice of allowing or rejecting cookies for any site, or for third-party hosts, comes down to how you want to balance security vs. usability.