Just FYI for Mac OS X users: Safari has a bug (also present in some old versions of Mozilla / Netscape 6.x) which makes it possible for third-party sites to steal domain cookies.

Hypothetically, this could allow a site you visit (even accidentally, or as an inline image) to steal your temporary session cookies and your stored password (if you selected "remember my password") from Wikipedia. A stolen password cookie could be used to login to the wiki with your user name; hijacking a session cookie may be possible as well.

I've tightened up the cookie settings on all other Wikipedias so that if you clear any old cookies you might have from them, the new cookies should no longer be vulnerable to this bug (because they will be set only for a specific hostname, eg fr.wikipedia.org, and the technique doesn't work on such a cookie). However the en.wikipedia.org/en2.wikipedia.org setup currently requires using the domain cookie to share sessions between the two servers and remains vulnerable. (Not to mention all those other web sites out there!)

If you're using Safari, consider clearing your stored cookies and disabling accepting new cookies until Apple releases a fix. Mozilla 1.5 and Camino 0.7 are not vulnerable and are very functional browsers.

-- brion vibber (brion @ pobox.com)