Consider a case, where an attacker has physical access of user's machine for 20-30 seconds.
The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies to himself (say by hangouts, facebook, mail, etc).
The account of the user is compromised forever.
I have tried out the experiment myself, where say XYZ's-cookie "X" is stolen from my system. After which I change the password of my XYZ account. Still the attacker can access my account by using cookie "X".
Also, sometimes it has happened with me that the cookies stolen ("X") when inserted in the browser doesn't work. I want to know why this weird behavior happens and what kind of state is stored in cookies. I have read about the expiry date to be stored in the cookie, but generally it's stored 1 year or so from the current date (am not sure about this fact though).
I also wanted to know if there's any method in current web architecture to prevent the click-jacking attack where cookies are physically stolen (as described above).