I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies.

I deleted this file but it seems like when I restart Chrome and try to browse for example facebook, website logs me in. So I got little confused why do websites still authenticating me even if I don't have cookies file. So my question is this. Is stealing Cookie file enough for someone to log in into any website that I was logged in? Hope you can help. Thanks.


Local storage?

In modern browsers Facebook also uses "Local Storage" (although I don't know if for login), which is different from plain old cookies. (Check using the F12 key.)

  • you can check it also in chrome://appcache-internals
    – Daniel Ruf
    Nov 19 '15 at 16:19
  • I don't think Local Storage would be used for storing user credentials since any data stored in it could be easily accessible by javascript unlike http-only flagged cookies.
    – LazyHands
    Nov 19 '15 at 16:22

Google keeps the passwords on their servers (aka cloud) and not local to your system. You can check your holdings by going to https://passwords.google.com/. Accordingly, your local store removal did not remove the entries.

This feature allows them to provide you their password management service across all your devices as long as you are logged in on a Chrome browser. Similarly, your web history is tracked and available from their cloud across devices as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.