Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there's no way to visit the page in the clear text. I'm also using a laptop that utilizes full disk encryption, and I'm the one who uses the machine. More over, I have 128bit auto generated passwords for each site on the internet, and each of the password is different. I also store the passwords in an encrypted keyring, just in case that I need them, but usually I don't because of the cookies. And here's the problem. Most of the internet sites (especially WordPress ones) have strange policy regarding cookies. In the case of WordPress, the default cookie expiration time is set to 2 days. If you checked the "Remember" option, that would be 14 days. So once for a while you have to log in whether you like it or not.
Is this necessary? I mean, what would happen if the cookies have no expiration time set? Is there a way to steel them somehow? If you have the whole site encrypted, and no one can access your machine, should you still be worried about cookies that are sent through the internet? I've never been asked, for instance, by google for password while checking my emails.