If the path is excluded the path of the original request is used. Using 'secure' you can choose if the cookie should be sent only over an SSL connection. If there were a large user acceptance, a standard could develop to automatically control automatic logging on to Web sites using the user preferences. That would bring about the possibility of individual, dynamic page creation for every user. Even a lively swapping of cookies between various organisations can't be ruled out.
Cookie files are generally unencrypted.
Only actively making changes manually prevents a Web server making a writ access to local files. Because the cookie file isn't available on Unix systems as standard, this file should be created by hand and also be write protected this way. Information read from an empty file doesn't give anything away. Even under Windows practical protection is only achieved using the read-only flag. Various cookie Web pages use two further 'turning off methods' for using Navigator for Windows, which don't have an effect for the 16 bit versions 2.00 and 2.01 though.