Does signing out of a website ensure no-one can cookie hack?

Question

If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it?

While I'm logged in, is it possible for someone who has access to my computer's hard drive to simply grab the cookie and then sign in?

Does something like Gmail's 2-factor authentication help in any of the above scenarios?

Answer 1

The answer here depends on how the website handles cookie management. If they're doing things correctly, following the signout link should invalidate the cookie on the server-side and also remove it from the client.

As such if an attacker got access to your PC after that they shouldn't be able to mis-use the cookie, even if they could get access to it.

If you're still logged in and leave your PC, without shutting the browser, it's likely that an attacker could grab the cookie just by using the browser. If they only have access to your hard drive (eg, over a network), they may be able to get access to the cookie file, but it could be somewhat more tricky to exploit.

two-factor authentication may help in the scenario where someone steals a cookie while you're logged in, but while the session is ongoing it's likely there will be cookies on the machine which will provide access.

The safest bet is to ensure that you log out of all sessions before leaving your computer and also close the browser (a lot of session cookies are removed from the client when the browser is closed)

Answer 2

Generally speaking, this really depends on how the server implements the cookie-based authentication.

• If the server uses the cookie as an indexing key into the server database, which the server uses to recover all the session information, then "signing out" means having the server forget all about the session -- at which point the cookie becomes worthless for the attacker, since it references no existing session anymore. In that case, signing out protects you against cookie hijacking.

• If the server stores the session information inside the cookie itself (preferably encrypted and with a MAC so that users cannot "invent" or tweak sessions by themselves), then "signing out" means having the browser forget the cookie. It does not change anything server-side; if an attacker got a copy of the cookie before the erasure (or if the erasure was not very effective, e.g. the attacker copied the hard disk and recovered the erased file), then he can use it to re-enter the session.

As for grabbing the cookie from the hard disk, it is usually simple. For instance, on my machine, it seems that my Web browser (chromium) locally stores cookies as a SQLite database, i.e. a single file with no protection whatsoever.

Authentication is something which is done when the session is created; so it is mostly irrelevant for the discussion at hand. Although a server could add some additional protections such as rejecting a cookie if it does not come from the same IP address than previously (this will partially thwart some attackers but may also be inconvenient for honest users who have a dynamic IP).

Answer 3

Within a web application logging out results in the cookies expiration date being set in the past this triggers its removal by the browser. So essentially logging out deletes the cookie.

It all depends on how the site makes use of cookies. A good system will simply store an authentication token that is then checked against the system to ensure its valid. The authentication token may take aspects such as the users browser and ip address into an account so that even if an attacker obtained the cookie they would have to spoof these as well to successfully authenticate with it. A bad system might just store the users password in the cookie either in plain text or just as a hash either way would be very bad and would mean an attacker could make use of the details.