Collected research

The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information

Suphannee Sivakorn, Iasonas Polakis and Angelos D. Keromytis · ieee-security.org

Sites that still serve some pages over HTTP leak their non-session cookies to any network eavesdropper. An audit of 25 major services shows those stolen cookies expose search history, home and work addresses, purchase history and contact lists, and can even send mail from the account; a month of campus traffic found 282,000 exposed accounts, and Tor users are deanonymisable the same way.

Record

Researcher

Suphannee Sivakorn, Iasonas Polakis and Angelos D. Keromytis

Published by

ieee-security.org

Format

Whitepaper

Topic

HTTP

In the archive

• Collected in the 2016–17 research round

Related sources

• The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information

Tags

• cookie
• info-leak
• https
• http
• auth-bypass
• measurement-study
• large-scale-scan
• owasp-a01-2021
• owasp-a02-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Suphannee Sivakorn, Iasonas Polakis and Angelos D. Keromytis, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.