Cookies, Tracking, Downloads and Private Browsing

Lesson 5.7 dealt with one of the four everyday browsing issues Dr. Al-Doori describes in Chapter 17: HTTPS. This lesson covers the other three: the files you download, the cookies websites leave in your browser, and the history your browser keeps. Each comes with a small habit that makes a real difference.

What you'll be able to do

Manage cookies and downloads deliberately and use private browsing knowing what it does and does not hide. By the end of this lesson you will be able to:

• explain what cookies are, how they keep you logged in, and how they are used to track you across sites;
• explain why a stolen login cookie can be as dangerous as a stolen password, and how to limit that risk;
• treat downloads with the same care as email attachments, and use private browsing for what it is actually good at.

Cookies: Small Files With Two Faces

A cookie is a small piece of data a website asks your browser to store, so it can recognize you the next time you visit. Without cookies, the web would forget you on every click: you would have to log in again on each page, and shopping baskets would empty as you moved around a store. That convenience is the first face of cookies, and the book is clear that it is genuinely useful.

The second face is tracking. It helps to know two types:

• First-party cookies are set by the site you are visiting, for example to keep you logged in or remember your language.
• Third-party cookies are set by other companies whose content is built into the page, such as advertising networks or social media buttons. Because the same company's content appears on thousands of sites, its cookie can recognize you on each of them and build a picture of where you go and what interests you.

Dr. Al-Doori's advice still stands: review your browser's cookie settings, and clear or block cookies where privacy matters to you. Many sites now also show cookie banners asking for your consent. Instead of clicking "Accept all" out of habit, take two seconds to choose "Reject" or "Necessary only" when that option is offered.

Login Cookies Are Keys

When you sign in to a website, it usually gives your browser a special session cookie, a kind of temporary pass that says "this person has already logged in". Every time you click, your browser shows the pass, and the site lets you through without asking for your password again.

That makes a session cookie as valuable as a key. Microsoft Threat Intelligence describes how infostealer malware (Lesson 5.1) collects browser data, including these login cookies, and how criminals use stolen cookies to get into accounts. With a valid session cookie, a criminal can skip the login step entirely, including your password.

You can't see or guard cookies directly, but you can limit the damage:

• Keep the device clean: automatic updates, built-in protection, and software only from trusted sources (Lessons 5.3 and 5.4), so infostealers don't get in.
• Sign out on any computer that isn't yours, which ends that session.
• Don't save logins on shared or public computers. Saving passwords in your browser is reasonable on your own devices, never on shared ones.
• If you suspect a compromise, sign out of all sessions from your account's security settings, as well as changing your password (Lesson 6.1). Changing the password alone may not end sessions that are already open.

Downloads: Treat Them Like Attachments

The book makes a simple comparison: a download can carry malware just as easily as an email attachment, so treat it with the same caution. Only run files from sources you trust. In practice:

• get software from official app stores or the maker's own site, reached by a bookmark or typed address (Lesson 5.3);
• be suspicious of pages full of large "Download" buttons, which are often adverts;
• look at what you actually received: a "document" that turns out to be a program is a warning sign;
• never paste a command a web page gives you to "verify" or "fix" something (Lesson 3.3).

History and Private Browsing

Your browser keeps a history of the pages you visit. On your own device that is convenient; on a shared or public computer it can reveal where you have been, which is why the book advises clearing it or using a private window when you are not on your own device.

Private browsing (called Incognito in some browsers) is useful, but it is often misunderstood. When you close a private window, the browser doesn't keep that session's history, cookies or form data on that device (files you download and bookmarks you save do stay). That is all it does. It does not hide your visits from the websites themselves, from whoever runs the network (your school, workplace or the café Wi-Fi), or from your internet provider. And it does not protect you from malware or phishing. Use it for what it is good at: keeping a shared computer from remembering you.

Real-World Example

Imagine Sara downloads a "free" cracked version of a paid design app from a forum. It installs, but it also installs an infostealer. Over the next minute, the malware copies the saved passwords and login cookies from her browser and sends them off. Sara uses strong passwords and multi-factor authentication, but the criminal doesn't need them: the stolen session cookie for her email is still valid, so he opens her inbox as if he were her and starts sending scam messages to her contacts.

When Sara notices, changing her password is not enough. She also uses "sign out of all sessions" in her account settings, removes the cracked app, runs a full scan, and follows the rest of Lesson 6.1. The download was the door; the cookie was the key.

From the Book to 2026

What the book teaches. Chapter 17 advises treating downloads like email attachments, managing cookies because they enable tracking as well as convenience, and clearing history or using private browsing on shared computers.

Why it made sense. All three habits remain sound, and the book's point that cookies have two faces is still exactly right.

What has changed. Security guidance has evolved since the original text. Cookies are now also a target for theft: infostealer malware collects login cookies so criminals can enter accounts without passwords. Cookie consent banners have become a common way for sites to ask your permission. And private browsing is now widely available, but it is often mistaken for an invisibility cloak.

What to do now. Current guidance now recommends keeping devices free of infostealers, signing out of shared computers, using "sign out of all sessions" after a suspected compromise, choosing your cookie options deliberately, and using private browsing only for what it really does.

Watch: How cookies can track you

This video from Simply Explained shows, step by step, how a cookie keeps you logged in and how the same mechanism lets companies follow you across the web.

As you watch, notice:

• why cookies were invented in the first place, to remember a shopping basket, and why websites forget you without them;
• how a social media button placed on someone else's blog lets that social media company recognize you there;
• the advice to look at what a cookie banner is asking for, and why, rather than simply accepting.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

You are using a library computer to check your email before a bus leaves. You are in a hurry, and the browser offers to "remember your password". What do you do when you have finished?

Knowledge Check

Key Takeaways

• Cookies keep you logged in and remember settings, but third-party cookies also track you across sites. Choose your cookie options deliberately.
• A login (session) cookie works like a key: infostealers steal them to enter accounts without passwords.
• Sign out on shared computers, and use "sign out of all sessions" after a suspected compromise.
• Treat downloads like email attachments: only run files from sources you trust.
• Private browsing keeps a shared device from remembering you; it does not hide you from websites or networks.

Sources

• Microsoft Threat Intelligence — Think before you Click(Fix): Analyzing the ClickFix social engineering technique (2025)
• UK National Cyber Security Centre — Top tips for staying secure online: password managers
• UK National Cyber Security Centre — Recovering a hacked account
• Google Chrome Help — Browse in Incognito mode
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 17