This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure.

I'm seeking to know how secure it is to let the browser leave data on the computer after I close it. For all it's worth, I'm regarding to security as malware not being able to extract your data. A thief sitting on your already-logged-in computer is besides the point.

I'm sure in the past this was definitely not secure. That is why I have kept the habit of having Firefox clear every data upon close (or install an add-on for chrome to do that1). Admittedly though, it's not at all convenient. I wouldn't save passwords, form and search history, browse history etc anyway, but clearing cookies and active logins means I spend some time every time I open a browser just to login to various websites that I commonly visit.

My question is regarding how the browsers (probably needs different answers for each browser) store information and how secure are they? In particular, how secure is the storage of each of these elements?

  • Cookies
  • Active logins
  • Offline website data
  • Site preferences
  • Cache

(The terms taken from Firefox settings, where you choose what information to clear upon exit).

1 Is chromium so secure (or so it thinks) that it doesn't need to clear stored data?

P.S. I have seen this question, which seems to be Windows specific. I use both Windows and Ubuntu, so this question is not entirely answered by the other one.

1 Answer 1


It really depends more on the services you are accessing than on your local system. If you are not storing passwords, not using persistent logins and the services you are accessing are following good security, then any session cookies on your system should only be good from your current connection and should be useless to a remote attacker. If your computer is so thoroughly compromised that an attacker could use the cookies from your machine, then clearing won't matter since they could either back them up or simply access your accounts while you are using them.

The main gain from clearing caches is privacy. It prevents (or at least makes it more difficult) for people to tell what your online activity is at all. There is some amount of security information leaked too if someone can see that you bank with ABC Bank Corp. and maybe even get your username, but they shouldn't be able to access your account simply from the cache unless someone is doing something very wrong.

  • Can you explain what are the difficulties in making it secure if you do use persistent logins for example? Why after so many years can't Firefox (or others) keep your persistent login without compromising your security?
    – Shahbaz
    Mar 29, 2013 at 12:42
  • @Shahbaz - a persistent login can be implemented several different ways. The most common is a persistent cookie on the local machine that can be used to login without a password in the future. It also can frequently be used from a different IP. I suppose a way could be invented for a site to tell the browser that the cookie needs to be protected with a password, but then you just defeated the whole point of a persistent login. Anything a user can do without a password, a piece of malware on the computer can do without a password. Mar 29, 2013 at 13:03
  • Is that so? Couldn't they store cookies in some encrypted form?
    – Shahbaz
    Mar 29, 2013 at 13:20
  • @Shahbaz and encrypt it with what? If it can be accessed without a password, then the malware can get it. If it requires a password it defeats the purpose. Mar 29, 2013 at 15:59
  • Hmmm... I don't know. As you can see, I'm not much of a security expert. But I had thought since encrypted file systems exist, and since the OS doesn't keep asking for a password with every file access, there'd probably be a way to do it. Even though I understand your point.
    – Shahbaz
    Mar 29, 2013 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .