1

I am in the process of making a curated news website and I'm wondering about the safety/security of using unencrypted cookies to store basic user information (first name and zipcode). What are the security risks of using unencrypted (plain text) cookies to store this information, and what about for more sensitive information (ex. email, password, or even credit card number)? Can other websites view the cookies my site creates?

  • 4
    Storing the credit card info on the client would be an explicit violation of PCI guidelines... – Makoto Sep 26 '16 at 22:02
  • ...and there is never ever a valid reason to store a password in a cookie. If you feel the need to do that, you are doing it wrong. – Anders Sep 27 '16 at 9:22
2

What are the security risks of using unencrypted (plain text) cookies to store this information, and what about for more sensitive information (ex. email, password, or even credit card number)?

There are many ways you are putting user data at risk. Few of think listed below.

  1. There are many browser extensions that spy on user and their data. You are making their job easy.
  2. The cookies can be obtained by sniffing. This reveals sensitive information to the attacker. (Of course this can be prevented by setting secure flag on cookie and using https when visiting the site).
  3. The crash dumps of programs (browsers) may contain this sensitive data of the user and potentially leak them.
  4. Users may use public computers in internet cafe or kiosks. So, next user using that computer can see what I have done. Probably these cookies as well.
  5. Also, as mentioned by @Matthew, users can easily tamper with these cookies using a cookie editor extension, and see how the application behaves. (Let's say I changed the firstname in cookie to another person's, does this give me access to their account?)

Can other websites view the cookies my site creates?

Given the major browsers like Firefox, Chrome, this case will be considered a critical security bug. So, as long your users use a good browser your are good to go.

1

Firstly, the cookie is stored in plain-text on the end user's device. Secondly, it could be manipulated. Why would you be storing this in a cookie rather than the session's data? Anything stored in a cookie (especially plain-text) that you rely on can be tampered with.

With regards to the other sites, maybe. The domain attribute can restrict who can see it, but that relies on the browser to honor it and no other vulnerability to be exploited.

  • I'm storing the user's zip code in a cookie rather than in session data so they don't have to type it in every time the quit their browser (which deletes session data). Is there something I'm missing? — So you're saying that cookies are fine for basic info but not for sensitive info because of potential browser bugs. – owlswipe Sep 26 '16 at 22:30
  • Your session is managed by a cookie, too. Session ID management is an entirely different animal and best left to proven techniques... ASPSessionID (for .Net apps) is a common cookie you'll see set around for this very reason. Let the server manage data you care about. – Matthew Kosmoski Sep 26 '16 at 22:32
  • 1
    @owlswipe: if the problem you are trying to solve is how to persist data which you currently store on your server then fix that problem instead of creating new ones. – symcbean Sep 26 '16 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.