1

While surfing on the Internet, I am often afraid that I may have downloaded some malware program along with some files on my computer. Furthermore, I have been told that the reason for that are cookies and caches.

In the same order of idea, most of the sites I visit, there is a popup that says that they use cookies. And now I am wondering what are cookies and caches. Are cookies bad? If yes, what are the best ways to protect from it?

  • The popup for websites using cookies is actually there to satisfy UK law. Under the law, you must consent to the website storing data on your machine -- including cookies. See E-Privacy Directive of 2009, amended regulation 6. – Ohnana Dec 7 '15 at 17:43
2

As HTTP is the stateless protocol, which means a web server treats every request coming to it as an independent request i.e communication consists of independent pairs of request and response. So in order to maintain the session between client and server, cookies are one of the techniques to do so. There are various other techniques to maintain the session.

Cookies are the key value pair (for every unique key, a value is associated with it e.g. session_id = 12345). It is sent by the website and stored in the browser. The next time user visits the same website, the cookies are automatically sent to it.

Now coming to your concern "I visit, there is a popup that says that they use cookies", there is no issue regarding what cookies you receive from the website. A cookie on its own cannot do any harm to the system because it does not contain any code, but it can assist in attack, check Why is it necessary to scan cookies

Cache is the temporary memory which browser uses to make the user experience better by storing the frequently visited webpage information like .css files. It speeds up the process so that data does not have to be fetched from its original location and, therefore, saves time. From the end user point of view, one must not worry regarding security issues related to browser cache. As a developer, it is important to test the browser cache issues.

  • 3
    I think this is a strong answer but may be a bit over the head of the OP. For example, if they don't know what a cache is, I suspect that they won't know what a "stateless protocol" or "key value pair" are. Perhaps adding a simple summary to the beginning of the answer and then having the current answer follow as a more in-depth explanation would make the answer better aimed at the OP without losing any of the nice work that you've put into the answer already. – Neil Smithline Dec 4 '15 at 5:34
1

Are cookies bad? If yes, what are the best ways to protect from it?

They are not bad per se. Cookies are a way of tagging a web browser. This way they can tell if you have visited the website before or not. They could also have assigned you a unique identifier and stored it in the cookie. All the cookie is is effectively a text file.

It is more of a privacy concern that a website is storing cookies than a security one. Under EU law, a website must warn you that it is using cookies. This is the message you are seeing, however there is nothing in particular to be concerned about.

Some advertising networks set a 3rd party cookie. Say if a website you visit, Bob's Cars includes advertising it may call a script on adnetwork.example.com. This domain sets a cookie. You then visit Alice's Angle Grinders. This uses the same ad network and calls a script on adnetwork.example.com. Now the advertising network knows you are interested in cars and angle grinders and will be able to show you adverts for such items as you visit other websites.

There is currently a court case in Belgium against Facebook for their usage of such cookies without informing users.

Note that cookies cannot normally contain malware or executable content that is ran on its own. However, there have been vulnerabilities in old versions of Internet Explorer that allowed cookies to be used in an attack. You should not be concerned about cookies doing such evil if you update your browser to the latest version regularly.

If you are concerned about privacy, use Private Browsing or Incognito mode. This gives you a browser session with no cookies set and will also clear them when you close your session. Alternatively use privacy browser extensions such as Adblock Plus and Ghostery to limit the number of tracking cookies stored.

Cache is not evil either. These are just locally stored copies of internet files, such as images and client-side scripts. This is for performance reasons and so your browser does not have to redownload them each time you go back to a website you visit often.

0

Cookie is just a way to store information of the website you visit in your browser, say, to track your preference or active session. https://en.wikipedia.org/wiki/HTTP_cookie The website is just making you aware of that.

  • why is the warning necessary? – schroeder Dec 4 '15 at 4:27
0

Cookies are code sent from the site and stored in your browser to store data in order to remember or record that data across sessions.

Cache is a space of disk where your browser stores web pages (or part of them) "in order for a better surfing experience". Let's say you have cached webSiteA.com. When you ask the browser for that page, it will bring the "static content" from your cache and the "dynamic content" will came from outside your browser giving you better load speeds (cache concept is applied on many things: web servers, browser, memory, databases, etc.).

There are multiple attack vectors for these two concepts, like cross subdomain cookie attack or persistence cache poisoning, for example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.