I mean, when I tick the "remember me/this computer" button, I don't need to login again on this machine. So I guess it's because of cookies. So if someone would get on my PC, he could steal some files and put it into his browser to compromise my session. Is that possible?

  • At this moment you've got four answers and to my eyes neither addresses the question from the title "what", but that's partly because you answered it yourself. That leaves only a yes/no question. Is that all you wanted to know?
    – techraf
    Aug 24, 2016 at 3:43

4 Answers 4


The other answers are bad enough I've decided to post a clear answer...

So if someone would get on my PC, he could steal some files and put it into his browser to compromise my session. Is that possible?

Yes, if someone has physical access to your machine, and you have not secured your data with something like full-disk encryption, yes, session hijacking would almost-certainly be possible.

Browsers store their user profiles (including session cookies) to disk somewhere, and anything stored to an unsecured disk can be copied to another disk. You can essentially clone a profile in this manner.

There may be some minor tricks or issues involved either on the browser's or the website's end, so it might be slightly more difficult than a simple copy-paste job, but the basic issue is the same. If someone has access to your data, they can copy it and use it to impersonate you.

Physical Access is Total Access:

Of course, when a malicious individual has access to your device, there are a number of other attacks they could perform, such as replacing hardware to add hardware keyloggers and so-forth. Physical security for your device is still important.


As a hacker it is easy for him to attack you PC when he has physical access to the system. After having access to your pc, its not a matter of time he installs a backdoor in it and also keystroke recorder. After that he does not even have to steal you facebook sessions. Your device will be completely owned by the hacker. You yourself will be providing the credentials.

Even if the hacker does not have access to you PC, he only needs your sessions and cookies. These can be taken or steal from various ways. He can send you spam email and send the exploit, he can perform techniques like cookie hijacking, tabnabbing, session hijacking, session sniffing, XSS attacks. MITM (Man In The Middle) attack is a great way to sniff sessions. Every time you login to you facebook, it generates a session id and that only what a hacker needs to compromise you facebook sessions.


I mean, when I tick the "remember me/this computer" button, I don't need to login again on this machine

A person with physical access to your device does not need to hack anything:

Opens your browser > goes to browser settings > stored or saved passwords


  • 1
    If I read this question right, it is about a specific site, such as Facebook, implementing a "Remember me" checkbox, and not about using the browsers built in password manager.
    – Anders
    Aug 24, 2016 at 7:45
  • In my view the question is not asked correctly if that s the case.
    – Smeef1
    Aug 25, 2016 at 14:57

If an attacker would gain logical or physical access to your machine,

Yes it is certainly possible for him to steal your information and cause you much harm, not only in the immediate term, but also in your future.

I work as an IT Security professional and there are multitude of ways he can make your life miserable. I will illustrate with some examples:

Social Engineering

By exploiting your psychology, he can influence you to think that he is one of your friends or someone else you trust. After gaining your trust, he can steal your credentials to your account. You used your social media account as an example, which could contain personally identifiable information, such as your full name + DOB. This information can be used to steal your identity, open false accounts in your name, damage your reputation etc.

Session Riding / CSRF

This might have been patched, but it used to be possible for an attacker to sent you an link and trick you into clicking it, that would trigger an undesirable action such as stealing your information, while you are logged in. The basis for this attack is the trust the application has for the user's browser session. The application thinks the request came from you and does not know it was someone maliciously acting on your behalf. Be default, actions you, the user, takes are trusted.

  • 1
    While what you write here is true, I don't understand how it address the original question - what files could be stolen form a computer to compromise the session? Besides, I don't think Facebook is vulnerable to CSRF...
    – Anders
    Aug 24, 2016 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .