If a hacker makes a copy of all my browsing cookies, what could he/she do with that? What are the worst case scenarios?

  • 1
    See this relevant question: security.stackexchange.com/q/595/9792 . – dan Dec 15 '15 at 22:24
  • Thanks but it does not answer my question. – Bob Dec 16 '15 at 9:48
  • Down voting without comments is really cool! – Bob Dec 16 '15 at 9:48
  • 1
    This was a comment to help you improve your question on the basis of previous ones on the same topic (I didn't down vote this short but relevant question). – dan Dec 16 '15 at 10:07
  • The second comment was not for you Daniel :-) – Bob Dec 16 '15 at 11:05

That depends on what is in your cookie and how the web application use it. Let say, it is your logged-in session id/cookie (that you have not logged out), it could represent your identity. That means he can go in do whatever he wants, depending on the web application, including changing your password and take over your account.


This varies depending on the sites you use and how they treat them. In most cases where you don't have to login on returning to a site, the person who has copied your cookies would receive the same treatment.

How well this is implemented varies between sites. It could be as ugly as storing your actual password in the cookie (rare, but not unseen) or as good as providing a unique cookie for each sign in and providing a tool to revoke individual or all sessions.

Many implementations will revoke access on a password change and require that the old password be provided to set a new password, thus providing some manner of regaining control.


The core of the problem is that a web server is building trust on the basis of cookies which are under control of:

  • you,
  • your web browser,
  • any malware which could steal or modify them,
  • any hacker which may steal them by spying upon an http connection.

Among the worst case scenario you have:

  • as user bob, by accident or edition of your cookies, you get access as alice to the web server and hence to alice data,
  • a hacker may get a full access as bob to his web server,
  • a hacker may get a full access as bob but with a fake history of other visited web server, hence building a fake history of bob browsing (bob arrived on linkedin.com redirected from big-dick.com).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.