Hacker News Reader

Cookies can be encrypted and changed with every page load, verifying sessions server-side. Session tokens can expire on every page or x-seconds and re-issued by the server.

I think you just need one HTTPS only cookie (Amazon seems to have two) and just check that one (in addition to the others) at purchase time, since that one can't be stolen.

However, the sign in button is served from a insecure page, so a ISP could MITM that and get your password anyway.

it's easier to just hijack DNS anyways

> If i copy all of the cookies how will the server differentiate the hijacker from the user. They both have the same cookies.

If you set the cookies to be HTTP-only then you can't get at them from malicious JS.