CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web            9  2.3.4.2  ActiveX

2.3.4.3  Buffer Overflows 1 2 3 2.3.4.5  Signed Applets

Cookies and Privacy

A generic problem with cookies is that every time your browser sends a cookie back to a server, it’s giving someone information about you or your browsing habits. In the case of an e-commerce site using the cookie to look up the contents of your shopping cart from the last time you visited the site; this might not be something you mind. In the case of advertisers’ sites using cookies to inform a service like Doubleclick which sites you visit, so that they can construct a more complete profile of your browsing habits, this might be something you mind. To look at it from the other perspective, if you are a webmaster and you are using that sort of tactic to track users’ activities, you’re taking a risk as well –your user base may someday deluge your organization with bad publicity for its privacy infringing techniques.

Although most cookies are of the harmless shopping-cart-pointer variety, there are a number of services out there like Doubleclick that use them to learn more about you. To combat this, browsers offer a number of cookie management security features. For example, you can:

• Delete some or all of your cookies
  
  
• Automatically accept or reject cookies from certain sites of your own choosing
  
  
• Disable all use of cookies by your browser (which leads to frustration, since many sites don’t work right without them)
  
  
• Have your browser warn you when it is about to send a cookie to a server, and give you the option of not sending it (which may, as in the above case, lead to the site not working properly because it insists on receiving a cookie from your browser)
  
  
• Choose to save cookies only for the duration of this web browsing session (as opposed to permanently on disk)
  
  
• Disallow cookies that are to be sent to sites other than the main one you’re browsing (which protects against the kind of cross-site tracking done by Doubleclick and its ilk)

2.3.4.3  Buffer Overflows 1 2 3 2.3.4.5  Signed Applets