The TCP/IP Guide  9  TCP/IP Application Layer Protocols, Services and Applications (OSI Layers 5, 6 and 7)       9  TCP/IP Key Applications and Application Protocols            9  TCP/IP File and Message Transfer Applications and Protocols (FTP, TFTP, Electronic Mail, USENET, HTTP/WWW, Gopher)                 9  TCP/IP World Wide Web (WWW, "The Web") and the Hypertext Transfer Protocol (HTTP)                      9  TCP/IP Hypertext Transfer Protocol (HTTP)                           9  HTTP Features, Capabilities and Issues

HTTP Security and Privacy 1 2 3 Gopher Protocol (Gopher)

Issues with Cookies

Cookies sound like a great idea, right? Well they are—and they aren’t. On the positive side, cookies are absolutely essential for many of the applications that make the Web the powerhouse it is today, the examples of online shopping and discussion forums being only two of many. Most of the time, cookies are used for these sorts of useful and benign purposes. Unfortunately, like every good idea, there are those who have found a way to turn cookies to the “dark side” by finding ways to abuse them. There can even be potential problems with them when there is no nefarious intent. For this reason, cookies are rather controversial.

Some of the issues with cookies:

• Transmission of Sensitive Information: Suppose you use an online banking system. You log in to the server, which then stores your login and password (which controls access to your account) in a cookie. If the application is not implemented carefully, the message containing that cookie could be intercepted, giving someone access to your account. Even if it is not, someone knowledgeable who gained access to your computer could retrieve the information from the file where cookies are stored.
  
  
• Undesirable Use of Cookies: In theory, cookies should be a help to the user, not a hindrance. However, any server can set a cookie for any reason. In some cases, a server could set a cookie for the purpose of tracking the sites that a user visits, which some people consider a violation of their privacy. Since some Web browsers do not inform the user when a cookie is being set, they may not even be aware that this is happening.
  
  
• Third-Party or “Unintentional” Cookies: While most people think of cookies as being set in the context of a resource they specifically request, a cookie may be set by any server to which a request is sent, whether the user realizes it or not. Suppose you send a request to “http://www.myfavoritesite.com/index.htm” and that page contains a reference to a tiny image that is on the server “http://www.bigbrotherishere.com”. The second site can set a cookie on your machine even though you never intended to visit it at all. This is called a “third-party cookie”.

HTTP Security and Privacy 1 2 3 Gopher Protocol (Gopher)