Grabbing cookies can be done easily as an offline attack though, assuming they don't clear cookies on every shutdown (which I'd bet 99% of users don't). You sim

Grabbing cookies can be done easily as an offline attack though, assuming they don't clear cookies on every shutdown (which I'd bet 99% of users don't). You simply copy their cookies file/s from chrome and temporarily replace yours with it. I previously carried out a similar attack whereby I temporarily borrowed the hard-drive out of a housemates laptop when they had left it not locked in their room and gained access to many of their frequented accounts (after they had made a point of saying I wouldn't be able to gain access). I was able to maintain access for several months changing subtle things before someone else notified them and they cleared sessions. The cookies file is generally small enough to easily upload in the background if your passing around casual programming apps with friends. I don't condone this, but it's a very hard attack to mitigate without services breaking UX. Shopping websites do this by asking you to re-enter your password before changing account details/making a purchase, I'm not sure whether such a UX change would hurt social media. Note: This was all probably around 6+ months ago, chrome may have mitigated this exact attack since by encrypting the file with something Google account specific.