You are confusing how the attack is done. PKI has nothing to do with it. Try this with Chrome - 1) Log into a site on one computer 2) In the javascript consol

You are confusing how the attack is done. PKI has nothing to do with it. Try this with Chrome - 1) Log into a site on one computer 2) In the javascript console (tools->developer tools) type 'document.cookie' 3) On a separate computer visit the same site but don't log in. Open the javascript console. 4) Paste in the cookie, i.e document.cookie="keyofcookie=valueofcookie" 5) See if your authenticated using the account you 'stole' the cookie from without actually having to authenticate on the second computer (Rather then using two computers, you could use two different browsers on the same computer) Nowhere here was PKI used. One way to mitigate this type of attack is to store the users IP address server side and detect if they change IPs during the same session.