I am in the process of making a curated news website and I'm wondering about the safety/security of using unencrypted cookies to store basic user information (first name and zipcode). What are the security risks of using unencrypted (plain text) cookies to store this information, and what about for more sensitive information (ex. email, password, or even credit card number)? Can other websites view the cookies my site creates?
What are the security risks of using unencrypted (plain text) cookies to store this information, and what about for more sensitive information (ex. email, password, or even credit card number)?
There are many ways you are putting user data at risk. Few of think listed below.
- There are many browser extensions that spy on user and their data. You are making their job easy.
- The cookies can be obtained by sniffing. This reveals sensitive information to the attacker. (Of course this can be prevented by setting secure flag on cookie and using https when visiting the site).
- The crash dumps of programs (browsers) may contain this sensitive data of the user and potentially leak them.
- Users may use public computers in internet cafe or kiosks. So, next user using that computer can see what I have done. Probably these cookies as well.
- Also, as mentioned by @Matthew, users can easily tamper with these cookies using a cookie editor extension, and see how the application behaves. (Let's say I changed the firstname in cookie to another person's, does this give me access to their account?)
Can other websites view the cookies my site creates?
Given the major browsers like Firefox, Chrome, this case will be considered a critical security bug. So, as long your users use a good browser your are good to go.
Firstly, the cookie is stored in plain-text on the end user's device. Secondly, it could be manipulated. Why would you be storing this in a cookie rather than the session's data? Anything stored in a cookie (especially plain-text) that you rely on can be tampered with.
With regards to the other sites, maybe. The domain attribute can restrict who can see it, but that relies on the browser to honor it and no other vulnerability to be exploited.