# Might want to warn MSIE users about this:

**URL:** <https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325>\
**Category:** About This Message Board\
**Created:** [May 12, 2000, 6:18am UTC](https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325 "2000-05-12T06:18:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lovelee](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@lovelee](https://boards.straightdope.com/u/lovelee)\
**Post date:** [May 12, 2000, 6:18am UTC](https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325/1 "2000-05-12T06:18:52Z")

</div>

Quote:  
Any Web site that uses cookies to authenticate users or store private information – including [Amazon.com](http://Amazon.com), HotMail, Yahoo Mail, DoubleClick, [MP3.com](http://MP3.com), [NYTimes.com](http://NYTimes.com), and thousands of others – could have cookies exposed by Internet Explorer and intercepted by a third-party Web site.

* * *

[http://www.peacefire.org/security/iecookies](http://www.peacefire.org/security/iecookies)

Explains it much better than I could. I tried it with my SDMB cookie, and my password was stored, unencrypted, right in the cookie, visible to whoever wanted to take it.

I posted this here so the mods could decide what to do with it. Don’t want to cause undue panic, but it’s a reason to be cautious!

---

<div class="post-metadata">

**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\
**Post date:** [May 12, 2000, 3:25pm UTC](https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325/2 "2000-05-12T15:25:58Z")

</div>

Not to cause a panic here or anything, but you’re right.

Security on the Net is mostly a myth.

It goes deeper than that; I’m sure most of you were not aware of this, but any system administrator can read a server log and see passwords all day long. You are dependent upon their goodwill and trusting that they will not use this information in ways that would hurt you.

It’s like sitting down with strangers for a friendly game of poker; you wanna believe in everybody . . . but just the same, you cut the cards.

Use different passwords for everything.

Change them often.

Be mindful that while most people do have good intentions, there’s always some jerk out there who doesn’t. Hopefully you won’t run into that jerk . . . today.

your humble TubaDiva  
Administrator

---

<div class="post-metadata">

**Author:** ![HorseloverFat](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@HorseloverFat](https://boards.straightdope.com/u/HorseloverFat)\
**Post date:** [May 14, 2000, 8:59pm UTC](https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325/3 "2000-05-14T20:59:12Z")

</div>

This exploit works for any browser using Javascript, so you can include Netscape in your warning. I’ve seen it work on both browsers.

---

<div class="post-metadata">

**Author:** ![JonF](https://avatars.discourse-cdn.com/v4/letter/j/cab0a1/32.png) [@JonF](https://boards.straightdope.com/u/JonF)\
**Post date:** [May 14, 2000, 11:39pm UTC](https://boards.straightdope.com/t/might-want-to-warn-msie-users-about-this/19325/4 "2000-05-14T23:39:31Z")

</div>

> [@](#):
>
> This exploit works for any browser using Javascript

According to Peacefire, MSNBC, CNET, ComputerWorld, Newsbytes, and my own experimentation this is not so. It works in a browser using JavaScript _and_ not handling % codes in URLs correctly. I can’t duplicate the exploint in Netscape 4.72 or Opera 4.0 beta 3.

How do you do it in Netscape?