3 ms·
They store access tokens to your private accounts ie. Gmail. They/future hackers can use them to access your accounts.
by danr4 11y ago
They store access tokens to your private accounts ie. Gmail. They/future hackers can use them to access your accounts.
- striking 11y agoThey can't steal cookies, because HttpOnly exists: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl... They can take your passwords, though. If you install an extension that "can access your data on all sites", I hope your trust is well-founded.
- borski 11y agoTo be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. Scary.