A Cookie is a small file placed on a computer by a Web site that contains the user's profile and preferences regarding that site. HTTP, the protocol that provides the underpinnings for the Web, cannot track user actions in successive online sessions. As a convenience to users, an extension was devised to enable maintenance of a state, a memory of previous events, across multiple HTTP requests and responses. Defined in RFC 2109 in 1997, Cookies are tokens contained within HTTP requests and responses that enable Web sites to "remember" the user from visit to visit. If Cookies are set per session, they remain in volatile memory and expire when the user closes the browser, or at a pre-configured expiration time, such as a month, for example. These persistent Cookies remain on the user's computer, residing in a "Cookies" file on the user's hard drive. Persistent Cookies present an attractive target to hackers. By "sniffing" or reading your Cookies, criminals can get enough personal data to steal your identity or infer information for other kinds of fraud. Tracking Cookies monitor users' activities across multiple Web sites. Tracking within one site is typically done with the aim of producing usage statistics. Tracking across multiple sites is typically done by advertising companies to produce anonymous user profiles, which are then used to target advertising based on user profile. Most browsers support Cookies and enable users to set rules for Cookie usage. In addition to choosing whether Cookies shall be accepted or not, users can opt to accept or reject certain Cookies from specific domains; disallow third-party Cookies; accept only non-persistent Cookies; and allow a server to set Cookies for a different domain. Additionally, browsers may also allow users to view and delete individual Cookies. Third-party Cookies are a concern to the privacy and security of users. While Cookies are only sent to the server setting them or a server in the same Internet domain, a Web page could contain images or other components stored on servers in other domains. Cookies that are set during retrieval of these components are called third-party Cookies. For example, an advertiser could track a user across all pages where it has placed advertising images. Such a comprehensive knowledge of the Web sites an individual user visits would enable the advertiser to deliver highly targeted advertisements to this user. This technique is a form of Spyware. |