The advert the user sees at a particular site may not come from that site's server, but from an ad agency's server. The agency's site may be invisible to the user, but it is still able to set and retrieve its own cookies. However, the agency might have access to its clients' databases. The user might have filled in a form to buy a CD, for example. So far the dangers explained assume the cookie system works as intended.
Bugs can make matters worse.
In May this year a flaw in Microsoft's Internet Explorer emerged that let any server read cookies belonging to other sites, given the name of the site. The vulnerability, called the Open Cookie Jar, allowed hackers to monitor browsing habits. Ian Kilpatrick, group managing director of e-business infrastructure firm Wick Hill group, explains. All a hacker needs is the email address of, and a little information on, a clerk who deals with mergers and acquisitions, for example. If he is interested in genealogy, the hacker can develop a family tree site, and send the clerk information about it.