What are “Cookies”? Are they dangerous?

Posted on: July 8th, 2010

There’s considerable amount of false and alarming data is in circulation on this subject. They originate from the early times of the World Wide Web when it was a hot topic and a lot of personal oppinions got mixed up with facts.

Cookies are small files that certain websites create on your computer when you visit them. They are necessary because they are the main methods of passing information from one webpage to another. This is very useful in eliminating the need of entering some information over and over.

The most common example of a cookie is when you go to, let’s say, Yahoo.com to check your email. You sign in and go about checking your mail, answer some, etc. If you notice you don’t have to sign in each time when you open up a new email (which pulls up a new page). A cookie created by Yahoo makes this possible. It contains your the ID for your email checking session and that ID is provided to Yahoo’s web server each time your computer requests a page from Yahoo.com. That way Yahoo’s web server knows that the page request belongs to that authenticated session and serves the appropriate content. Without that you’d have to sign in each time you change a page.

Another very common example is a shopping cart. The items you selected are stored in a cookie on your computer so when you look around on different pages on the website, or go to another website your items still be there when you want to check out.

Ok. That sounds innocent enough, right?

The only thing about cookies that got people concerned is that it can be used to track what websites you visited, etc. Also depending on the website’s code, a cookie might store information that you entered, such as a user name, or your name. But it’s important to note that the only information a cookie could contain is what web pages you visited and maybe some data that you entered.

It’s another important information is that a cookie always belongs to one website and only that website can access the information stored in that cookie. Websites have no control over what cookies they get served, it’s solely the browser’s responsibility. So if you are logged in to a banking website and after that you visit a dubious website there’s no way that the latter website could access any banking related info.

Without going into much details it’s possible, via advertisements placed on websites, to track which websites you visited that had that same kind of advertisement on them. Personally I don’t see a great danger in this. No personal information can be gotten this way but some people are a bit too touchy about privacy.

So, are they dangerous? Definitely not. Cookies do not harm the computer in any way, they can be eliminated with the greatest of ease (for example by CCleaner). They are a necessary component of web browsing, you can disable them but then many website will not function properly.

So, if your security software keeps finding tracking cookies repeatedly, there’s no reason for concern. It just means you visited sites that have third party advertisements on them.

Bank Websites and Cookies

Banking website do use cookies. Every website that has some kind of authentication needs to use them. Deleting cookies can cause some unexpected results with banking websites. Here is why:

One of functions of a cookie is recognizing your specific browser / computer combination, were you to return to the same site. So the cookie placed by the bank’s website tells it that you have used that computer previously to log in to the bank’s site. With that confirmed it will only ask you for a user name / password combination to let you in.

But if you change computer, change browser or delete your cookies (they have all the same effect) the bank’s website assumes that it is an attempt to log in from a previously not used location. And because banks take extra security precautions it will have you go through some loops to verify your identity before it allows you to log in.

For example here’s a page you’d get with Chase. They have a system where they send you an “identification code” via phone. That’s their way of verifying identity but other banks might do other things.

So if you do a cleanup on your computer that deletes the cookies then you can expect to go through the process after each cleanup. If this gets too annoying then you can choose not to delete cookies in the cleanup software.

Now, if you have trouble logging in to a banking website, or other website for that matter, then in most cases a simple cleanup of cookies resolves the issue. When you are cleaning up cookies make sure you close your browser windows so that all cookies may get erased.