Show HN: AccessURL – share access to websites without giving away your password

Wouldn't that person be able to change my password with those cookies?

Also, if the browser extension has the key to decrypt the data, anyone can get that key.

Do you store the session cookies in your server and then serve them out again later? If so, how do you handle HttpOnly cookies?