Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure.

I'm seeking to know how secure it is to let the browser leave data on the computer after I close it. For all it's worth, I'm regarding to security as malware not being able to extract your data. A thief sitting on your already logged in computer is besides the point.

I'm sure in the past this was definitely not secure. That is why I have kept the habit of having Firefox clear every data open close (or install an add-on for chrome to do that1). Admittedly though, it's not at all convenient. I wouldn't save passwords, form and search history, browse history etc anyway, but clearing cookies and active logins means I spend some time every time I open a browser just to login to various websites that I commonly visit.

My question is regarding how the browsers (probably needs different answers for each browser) store information and how secure are they? In particular, how secure is the storage of each of these elements?

  • Cookies
  • Active logins
  • Offline website data
  • Site preferences
  • Cache

(The terms taken from Firefox settings, where you choose what information to clear upon exit).


1 Is chromium so secure (or so it thinks) that it doesn't need to clear stored data?


P.S. I have seen this question, which seems to be Windows specific. I use both Windows and Ubuntu, so this question is entirely answered by the other one.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It really depends more on the services you are accessing than on your local system. If you are not storing passwords, not using persistent logins and the services you are accessing are following good security, then any session cookies on your system should only be good from your current connection and should be useless to a remote attacker. If your computer is so thoroughly compromised that an attacker could use the cookies from your machine, then clearing won't matter since they could either back them up or simply access your accounts while you are using them.

The main gain from clearing caches is privacy. It prevents (or at least makes it more difficult) for people to tell what your online activity is at all. There is some amount of security information leaked too if someone can see that you bank with ABC Bank Corp. and maybe even get your username, but they shouldn't be able to access your account simply from the cache unless someone is doing something very wrong.

share|improve this answer
    
Can you explain what are the difficulties in making it secure if you do use persistent logins for example? Why after so many years can't Firefox (or others) keep your persistent login without compromising your security? –  Shahbaz Mar 29 '13 at 12:42
    
@Shahbaz - a persistent login can be implemented several different ways. The most common is a persistent cookie on the local machine that can be used to login without a password in the future. It also can frequently be used from a different IP. I suppose a way could be invented for a site to tell the browser that the cookie needs to be protected with a password, but then you just defeated the whole point of a persistent login. Anything a user can do without a password, a piece of malware on the computer can do without a password. –  AJ Henderson Mar 29 '13 at 13:03
    
Is that so? Couldn't they store cookies in some encrypted form? –  Shahbaz Mar 29 '13 at 13:20
    
@Shahbaz and encrypt it with what? If it can be accessed without a password, then the malware can get it. If it requires a password it defeats the purpose. –  AJ Henderson Mar 29 '13 at 15:59
    
Hmmm... I don't know. As you can see, I'm not much of a security expert. But I had thought since encrypted file systems exist, and since the OS doesn't keep asking for a password with every file access, there'd probably be a way to do it. Even though I understand your point. –  Shahbaz Mar 29 '13 at 16:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.