Solved The Cookie Monster(s) Return

Patsy1011 · Nov 12, 2024

MWB has recently discussed via their newsletter that creeps are gaining access to sensitive information through a person's cookies! I log off after each session and instruct browser to delete all cookies except: I have about 11 sites that do not get dumped so I don't have to enter a password when returning to that site.

Now I don't know what to do. Does this news imply that all cookies must be dumped after a log off?

Help.....

Berton · Nov 12, 2024

Does MWB stand for Malwarebytes or Mission Beyond Borders [like our church is involved with]?

andrew129260 · Nov 12, 2024

There are a million security threats every day. I wouldn't worry about it.

However, you can for anything sensitive use a private browser window which will delete all cookies and history once its closed.

neemobeer · Nov 12, 2024

Specifically threat actors are after session cookies.
A session cookie is generated after a successful login and is used as a means to validate you are who you state you are. Cookies exist because HTTP(s) is stateless and the cookie adds a sudo session persistent so you don't have to login everytime.

Threat actors will use any and all methods for gaining access including stealing cookies, and there are many more methods. Does that mean you should remove them, that is up to you. If you have layered defenses in place you should be safe with leaving them. Session cookie creation will vary by site but could in theory be generated based on user attributes to help reduce the risk of cookie theft/reuse, but it's impossible to tell how a cookie is created and validated server side

glasskuter · Nov 12, 2024

If one is concerned about cookies, instructing the browser to empty after each session coupled with using a password manager is an excellent alternative. I've used Roboform for many years to do just that. It replaced me making bookmarks in the browser for any place that requires login and is now my one-stop bookmark/login solution except for some old bookmarked sites that I rarely, if ever, go to anymore.

Many people do not know that they can extend the time how often they are required to enter their master password within the PW manager's settings. I have mine set for once ever 12 hours. I'm sure other PW managers have something similar, though I've only ever used Roboform. Of course one has to enter a master password if the computer is restarted or after a shutdown. I pay for Roboform and sync my login data across all my devices, both windows and ios. But many of the popular password managers offer a free version for one device. In this case there is no syncing across devices. For anyone interested in using a password manager, do a little research,. You will find one suited for you.

neemobeer · Nov 12, 2024

One caveat about deleting cookies...
If someone were to steal the cookie while you were logged in and you simple delete the cookie. The website still trusts that cookie potentially until you log back in or depending how the server issues, validates and hopefully expires cookies it could be trusted indefinitely. Deleting cookies in the latter scenario will do nothing for your security.

andrew129260 · Nov 12, 2024

neemobeer said:
One caveat about deleting cookies...
If someone were to steal the cookie while you were logged in and you simple delete the cookie. The website still trusts that cookie potentially until you log back in or depending how the server issues, validates and hopefully expires cookies it could be trusted indefinitely. Deleting cookies in the latter scenario will do nothing for your security.

Great point.

As you said, It really all depends on how the website handles it, which is impossible to know.

My thinking was on the line of not using the logoff button and just closing the tab as most people do. Deleting the cookie with that session data will force you to log on again, but yeah if the cookie is stolen we don't know how the site handles an active cookie or how quickly it removes the session on its end.

That's personally why I wouldn't worry about it. You can only do so much.

echo2446 · Nov 12, 2024

They can get your cookies only if you have malware on your system. Concentrate on following practices so that you don't get malware on your system.
In case you miss in 1 anyway, don't leave your most important accounts logged in. Always log out on those accounts. Use browser features / extensions / external tool (like CCleaner) to manage deleting the cookies.
For important accounts you need to leave logged in anyway (Microsoft? Google?), learn about their account recovery process and maximize the chance that you would be able to retake controls of your accounts. For Google, as an example, use a different recovery-only email/phone number, different from your main ones so that if somebody steals your main phone, you can recover the accounts without the phone.

The most important step is 1 above. Once you get malware on your systems, you will have to spend time getting rid of the malware and the intruders from your accounts regardless. Don't download, install or run malware!

antspants · Nov 12, 2024

I believe the question here is how does Patsy save the cookies for the sites that Patsy wants to stay logged into.
She and I (& others) have discussed this but neither the browsers or CCleaner has helped protecting session cookies that Patsy wants to keep, from being deleted.

Patsy did you try any cookie manager Plugins?

Patsy1011 · Nov 12, 2024

Thank you to all. I fear I know less than I should on so many levels. Every day a new threat of some sort. I have the protection of MWB (Mission With Biscuits -see Berton) and other AV stuff.

No AP I have not. I will google. Mama Glass..excellent suggestion.

glasskuter · Nov 12, 2024

Are y'all saying if you have edge set to clear your cookies on exit, and have certain cookies in your exclude list, that edge clears those cookies anyway? That Edge is not honoring your setting?.

antspants · Nov 12, 2024

glasskuter said:
Are y'all saying if you have edge set to clear your cookies on exit, and have certain cookies in your exclude list, that edge clears those cookies anyway? That Edge is not honoring your setting?.

Hi, lady L.
Most any browser actually. I tested extensivly in Firefox (because I believe it has the better Cookie Manager add-on) and Chrome. I also tested briefly with Edge
Those 3 browsers deleted ALL cookies when delete cookies on exit is set, this included when cookies are protected in that useless software CCleaner.

Patsy1011 · Nov 12, 2024

glasskuter said:
Are y'all saying if you have edge set to clear your cookies on exit, and have certain cookies in your exclude list, that edge clears those cookies anyway? That Edge is not honoring your setting?.

No -- using FF and have settings for managed cookies to keep. See my attach.

Patsy1011 · Nov 12, 2024

antspants said:
Hi, lady L.
Most any browser actually. I tested extensivly in Firefox (because I believe it has the better Cookie Manager add-on) and Chrome. I also tested briefly with Edge
Those 3 browsers deleted ALL cookies when delete cookies on exit is set, this included when cookies are protected in that useless software CCleaner.

I pay my taxes, return my library books on time, contribute to worthwhile endeavors and mind my business. I find it annoying as hell that another bunch of losers has found a way to possibly get into my private, personal online dealings. Cookies no less!!! I will, like all of you, keep the doors and windows locked and hope my online protection is sufficient. Thank you all again for your input.

antspants · Nov 12, 2024

Patsy1011 said:
No -- using FF and have settings for managed cookies to keep. See my attach.

Yes. I tested with all browsers, Firefox especially, they all delete session cookies regardless of saved cookie settings.

glasskuter · Nov 12, 2024

antspants said:
this included when cookies are protected in that useless software CCleaner.

No,. I don't mean cookies excluded in Ccleaner. Of course Edge wouldn't honor those exclusions. I mean cookies you have specifically told Edge to never delete. Same thing goes for exceptions list in Firefox. The excluded cookies are not deleted by the browser upon exit.
The browser settings do not protect from any 3rd party app deleting them, only from the browser itself deleting them..
If one uses Ccleaner, the same cookies to keep would have to be specified in Clcleaner's exclusions as well or Ccleaner will delete them.
I have some exclusions in both my browsers and they never get deleted.
If one is clearing cookies every time their browser exits, there's really no need to have Ccleaner deal with cookies at all. Just disable clearing cookies in Ccleaner settings. The remainder of its functions will still work.

antspants · Nov 12, 2024

glasskuter said:
I mean cookies you have specifically told Edge to never delete. Same thing goes for exceptions list in Firefox

Yeah tried that also.
My PC hasn’t been behaving though.

XxXxX · Nov 12, 2024

i use extension which auto deletes cookies except the ones i want to keep ie. log on details.

Cookie Auto Delete for Google Chrome.

Cookie AutoDelete - Chrome Web Store

Control your cookies! Automatically delete unwanted cookies from your closed tabs while keeping the ones you want.

chromewebstore.google.com

Cookie Auto Delete for Microsoft Edge.

Cookie AutoDelete - Microsoft Edge Addons

Make Microsoft Edge your own with extensions that help you personalize the browser and be more productive.

microsoftedge.microsoft.com

this still functions very well on my browser.
best of luck, Steve ..

Edwin · Nov 12, 2024

Patsy1011 said:
I have about 11 sites that do not get dumped so I don't have to enter a password when returning to that site.

Depending, perhaps, on your browser, dumping cookies won't clear your logon credentials, it mostly clears/resets site preferences,
such as this annoying banner! :wink:

antspants · Nov 12, 2024

Edwin said:
Depending, perhaps, on your browser, dumping cookies won't clear your logon credentials, it mostly clears/resets site preferences,
such as this annoying banner!

View attachment 116114

Try it with a Microsoft login. Deleted the session every time no matter what I did. But like i said, for me, my PC has been misbehaving.

Solved The Cookie Monster(s) Return

Active member

My Computer

Ret. ATC

My Computers

Well-known member

My Computers

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Active member

My Computer

aka Mama Glass

My Computers

Like a rolling drone.

My Computers

Active member

Attachments

My Computer

Active member

My Computer

Like a rolling drone.

My Computers

aka Mama Glass

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computers

♦ ♦

My Computers

Like a rolling drone.

My Computers

Similar threads