Browser cache, cookies, active logins and other data

Question

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure.

I'm seeking to know how secure it is to let the browser leave data on the computer after I close it. For all it's worth, I'm regarding to security as malware not being able to extract your data. A thief sitting on your already-logged-in computer is besides the point.

I'm sure in the past this was definitely not secure. That is why I have kept the habit of having Firefox clear every data upon close (or install an add-on for chrome to do that¹). Admittedly though, it's not at all convenient. I wouldn't save passwords, form and search history, browse history etc anyway, but clearing cookies and active logins means I spend some time every time I open a browser just to login to various websites that I commonly visit.

My question is regarding how the browsers (probably needs different answers for each browser) store information and how secure are they? In particular, how secure is the storage of each of these elements?

• Cookies
• Active logins
• Offline website data
• Site preferences
• Cache

(The terms taken from Firefox settings, where you choose what information to clear upon exit).

---

¹ Is chromium so secure (or so it thinks) that it doesn't need to clear stored data?

---

P.S. I have seen this question, which seems to be Windows specific. I use both Windows and Ubuntu, so this question is not entirely answered by the other one.

Answer 1

It really depends more on the services you are accessing than on your local system. If you are not storing passwords, not using persistent logins and the services you are accessing are following good security, then any session cookies on your system should only be good from your current connection and should be useless to a remote attacker. If your computer is so thoroughly compromised that an attacker could use the cookies from your machine, then clearing won't matter since they could either back them up or simply access your accounts while you are using them.

The main gain from clearing caches is privacy. It prevents (or at least makes it more difficult) for people to tell what your online activity is at all. There is some amount of security information leaked too if someone can see that you bank with ABC Bank Corp. and maybe even get your username, but they shouldn't be able to access your account simply from the cache unless someone is doing something very wrong.