4 ms·

They can't steal cookies, because HttpOnly exists: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-c

They can't steal cookies, because HttpOnly exists: http://blog.codinghorror.com/protecting-your-cookies-httponly/ http://blog.codinghorror.com/protecting-your-cookies-httponl... They can take your passwords, though. If you install an extension that "can access your data on all sites", I hope your trust is well-founded.

borski 11y ago
To be clear, they can definitely steal cookies if the HTTPOnly flag isn't enabled. About 60% of the session cookies we see in our scans don't have it enabled. Scary.