The difference is who makes the decisions: session id is controlled by the client. cookies by the server. FaceBook, Twitter etc. track you all over the intern

The difference is who makes the decisions: session id is controlled by the client. cookies by the server. FaceBook, Twitter etc. track you all over the internet with their cookies, even if you don't have an account with them, whenever a site puts up one of their icons for you to press "like". With client controlled session identifies, uses would get to choose if they wanted that. The reason YC gets by with 22 bytes is probably that they're not trying to turn the details of your life into their product.