Is using cookies from a web-browser a sane rationale for desktop application development?

Question

I am looking at making an application that would make OpenID authentication with desktop clients easy. The rationale is to steal the cookies from the web-browser, so as to avoid having to hard-code authentication to every possible OpenID provider.

Assuming the user has already logged on to the OpenID provider, the application clones the cookies from the default browser, and requests authentication to the desired service with the appropriate OpenID URL.

To make this application usable, I need to know what are the most commonly used web browsers used on Linux, possibly with statistical evidence. I assume that Firefox and Chromium are the two most popular at the moment.

NB: the title of this question was edited in view of the emphasis by respondents on security and standards.

Answer 1

"Stealing cookies from the web browser" in order to obtain authentication sounds like exactly the kind of thing malware would get up to in order to gain access to your personal information and login data.

If this approach turns out to work, I recommend you inform each browser's development team about a security hole in their software.

Answer 2

Stealing cookies from a web browser is a standard thing when you're writing a scraping script and don't want to deal with some complex website authentication in your script.

Traditionally, browsers stored their cookies in a simple text format inherited by Netscape, the cookies.txt format. Wget has an option --load-cookies to load a file like this.

Modern versions of Firefox and Chrome no longer use this format, but rather an SQLite database. There are extensions to make them dump a cookies.txt file, such as Cookie Exporter and cookie.txt export.

This is all very well for a script for use by technical-minded people, but I wouldn't do this in a general-public application. You are in for a world of hurt figuring out what browser to use (this user has three Firefox profiles and two Chrome profiles, which one should I look at?) and making users of less common browsers angry (Opera, Konqueror, Gecko, …). It's also a big hit on usability, even when it works: you're asking the user to do something in their browser before they can use your application, and not to do something in their browser (logging out of the site or erasing cookies) as long as they keep using your application.

I would still consider the approach reasonable if the target website was very hard to interact with. And even then, I would favor making your application interact with its own browser instance (using its own profile) with a browser automation framework such as Selenium or Watir. For a general OpenID login, I think it's best to invoke a known browser and make it spit out the authentication credentials.