By Jackson Guthrie

Browser cookies are bits of information stored on your computer that temporarily remember information about the user, including login credentials and authentication tokens. These provide ease of access to users, as a username and password are not required each time they navigate to a new page, or revisit another page. Cookies give your device a unique ID, which communicates to the website’s server that you are in fact, the same user accessing the site as before.

Because cookies are stored locally on your device, they can be stolen by malware and sold to malicious actors. When visiting a site, the server will request any cookies from your browser. If fed an active cookie, the server will allow access without the user ever seeing the login screen. If cookies are stolen, the server will recognize the imposter computer as your own, as it will have been found with your computer’s unique identifier. In many cases, this can even bypass multi-factor authentication.

Cookie stealing has been around for a long time, and both browser developers and hackers are sophisticating their efforts against one another. There are a few things, however, that users can do themselves to protect from such attacks. Checking for and eliminating malware from all devices should be the user’s primary priority. Malware is most often introduced to a device through phishing attempts. Learning about how to detect and deal with phishing attempts can reduce the chance of accidental installation of malware. When websites request to store cookies on a device, users should allow them sparingly. Users should also regularly clear cookies from their browsing history. Certain browsers allow for routine cleanings to be set by a user.

---