Cookies and Internet Privacy FAQ
What are cookies?
Cookies are a standard mechanism that allows a Web site (or server) to
deliver simple data to a client (or end user); request that the client
store the information; and, in certain circumstances, return the
information to the Web site. Cookies are a way of storing persistent
client data so that a site can maintain information on a user across
HTTP connections. ("Persistent" means that the information from the Web
site lasts longer than the immediate connection.) [top]
How do cookies work?
Cookies are small data structures delivered by a Web site to a Web
client. The Web site may deliver one or more cookies to the client. The
client stores cookie data on its local hard drive. In certain cases
(determined by the data in the cookie itself), the client returns the
cookie to the server that originally delivered it. [top]
Why are cookies useful?
Cookies allow Web sites to maintain information on a particular user
across HTTP connections. The current HTTP protocol is stateless,
meaning that the server does not store any information about a
particular HTTP transaction; each connection is "fresh" and has no
knowledge of any other HTTP transaction. "State" information is
information about a communication between a user and a server, similar
in many ways to frequent flyer profiles or option settings in desktop
software. (For example, a preference for aisle or window seats is
cookielike information that a frequent-flyer program might store about
one of its customers.) In some cases it is useful to maintain state
information about the user across HTTP transactions. [top]
What kind of client-side information can Web servers store?
Cookies can be used to store information about a user that either the
user or the Web site provides. Some scenarios include the following:
- Alice is shopping at a particular Web site that uses a shopping
cart metaphor. She puts items into a shopping cart by clicking a link
or an "Add to Shopping Cart" button. Cookies can be used to store the
contents of Alice's shopping cart so that she can conveniently purchase
a cart full of items rather than one item at a time.
- Bob clicks around a Web site that allows users to view articles for
a small charge. Cookies can be used to store information about which
articles he has viewed (that is, a list of URLs) so that he can pay for
them all at once rather than each time he downloads an article.
- Carl fills out a Web form with his name, address, and other
information. Cookies can be used to store this information so that the
next time Carl visits the site, the information is automatically
uploaded and he doesn't have to provide it again. If the form contains
sensitive information such as a credit card number or a mailing
address, the cookies can be delivered over Secure Sockets Layer, which
encrypts the information as it travels between the client and server.
- Don logs in to a Web site that requires a user name and password.
When Don's user name and password pair is successfully verified, the
server passes down a cookie that functions as a "guest, pass" allowing
him access to certain areas of the Web site. After a set time period,
perhaps half an hour or a day, the guest pass expires and Don must log
in again.
In each of these examples there are only two ways to store data: either
the server provides it (as in the last example) or the user provides it
by taking some action (such as clicking a link or button or filling out
a form). [top]
Can cookies read information from a user's hard drive?
No. Cookies can only store data that is provided by the server or generated by an explicit user action.
[top]
Can cookies be used to gather sensitive information, such as a user's email address?
Cookies cannot be used to gather sensitive information such as the
fields in a Netscape preference file. They can be used to store any
information that the user volunteers, for example by filling out an
HTML form. In this case, however, the same information can just as
easily (and with potentially more objectionable privacy concerns) be
stored on the server by using a simple server-side application that
stores user information in a database. Cookies are passive data
structures that are delivered to the client, stored on the client's
hard drive, and returned in certain situations to the same server that
provided the information in the first place. [top]
Where are cookies stored?
Cookie data is stored on the user's hard drive (although during actual
communication it is stored in memory). The filename is different for
each platform. For example, on Windows machines, cookie data is stored
in a file called COOKIE.TXT. [top]
Can programmers save client state information without cookies?
Yes. Client state information can be stored in several ways. For
example, server administrators and programmers can create a database
application that tracks and stores data they would otherwise have
managed with cookies. Cookies are simply a programming convenience. [top]
How long do cookies last?
A Web site may set an expiration date for a cookie it delivers. If no
expiration date is specified, the cookie is deleted when the user quits
Netscape Navigator. [top]
Can malicious sites read cookie information used by another site?
Cookies are designed to be read only by the site that provides them, not by other sites.
[top]
Can cookies be encrypted?
Yes. Programmers can require that cookies be delivered and received
only in the context of a Secure Sockets Layer (SSL) session. The SSL
session handles the actual encryption of cookie data. [top]
Can cookies be used to get a "snap shot" of my hard drive? Is this done? and how?
Cookies cannot be used to get data or view data off your hard drive,
early Javascript implementations could allegedly do this. This problem
has been plugged along with more serious Java exploits, and no-longer
poses any threat. A server can only get data from the cookie it wrote
to the cookie file. The server must be on the same domain from which
the cookie was set. [top]
Can someone from one site access the cookie information written by another site?
Site can only access a cookie that has been set from its own domain, It
cannot access any other cookies from your computer. Sites could access
other site's cookies, again this problem was plugged a long time ago. [top]
|
