Hacker News Reader

i think if you get a valid login cookie, and use it, it will tell you what account you have in the top right.

Well obviously, but you couldn't do a brute force attack like this to a specific account.

I believe the implication is that you'd have a sessionid. Effectively, the username and password rolled into one unique number, stored in the cookie.

I think by 'specific account' he means 'chosen account', in which case he'd be correct without more targeted social engineering.