Browsers & Accounts · How Accounts Get Stolen · Lesson 1 of 5

Session Cookies and Staying Signed In

Why a stolen session cookie can skip your password and two-step.

The wristband that keeps you signed in

When you sign in to a website, you type your password and maybe a two-step code. Then you close the tab, come back tomorrow, and you are still signed in. How does the site remember you?

A cookie is a small note a website saves in your browser. A session cookie is the special note that says "this browser already signed in". Your browser shows it to the site with every page you open, so you don't have to sign in again.

Think of a wristband at a concert. You show your ticket and ID once at the gate. After that, staff only look at the wristband. They don't check your ID again.

That is the weak spot. If a thief copies your session cookie, they can load it into their own browser. The website sees a valid wristband and lets them in. It does not ask for your password, because the password was already checked. It does not ask for your two-step code either, for the same reason.

This is called session hijacking, or a cookie theft attack. It is one way accounts get taken even when two-step is turned on. Two-step still matters a lot. It stops most attacks that start with a stolen password. It just can't protect a sign-in that already happened.

Where do thieves get cookies? Most often from malware, harmful software, running on your own computer, which you'll meet in the next module. Fake sign-in pages that pass your details through to the real site can grab them too.

Your account settings usually have a page called something like Your devices or Where you're signed in. It lists every active session. Each entry often shows a device type, a rough location and a time.

On the practice computer, open the account's devices and sessions page. Spot the session you don't recognize, sign it out, sign out all other sessions, change the password, and run a malware scan.

Kicking out sessions the right way

When you find a session you don't recognize, act quickly. Here is the order that works best.

1. Sign out that session. Most accounts have a button next to each device, such as Sign out or Remove. This makes that copied cookie stop working.
2. Sign out all other sessions. Many accounts also offer "Sign out of all other devices" or "Sign out everywhere". A thief may have more than one copy, so clear them all. You'll need to sign in again on your own phone and laptop. That is normal.
3. Change your password. On many sites, a password change also ends other sessions. It also stops the thief from simply signing in again.
4. Scan your computer. If malware stole the cookie, it can steal the next one too. On Windows, run a scan in Windows Security, as you learned earlier. On a Mac, keep macOS up to date, since its built-in protection checks for known malware in the background.

If you think your computer is infected, change important passwords from a different device you trust, like your phone. Then clean the computer before you sign in on it again.

Some good news. Browsers and websites are working on this problem. Chrome on Windows has started tying some sign-in sessions to a security chip inside the computer. A cookie copied to another machine then stops working quickly. This protection is new and not everywhere yet, so the steps above still matter.

Simple habits help too. Sign out on shared or public computers. Remove old devices you no longer use from the sessions list. Check the list now and then, the same way you check a bank statement.