title: What are the risks of storing a user password in a Cookie, when the connection is via https?
body: <h2>A Note</h2>
  
  <p>I have a very good understanding of sessions and the theory of secure web-based authentication, etc., so please don't start with the basics, or give ambiguous answers. I am not looking for Best Practices, because <em>I am aware of them</em>. I am looking for the real risks behind them, that make the Best Practices what they are.</p>
  
  <p>I have read, and agree with the principals that nothing more than a Session identifier should be stored in a Cookie at any given time. </p>
  
  <h2>The Story</h2>
  
  <p>However... I've inherited a rusty old app that stores the Username, Password, and an additional ID, in a Cookie, which is checked throughout the site as verification/authorization. </p>
  
  <p>This site is always (can only be) accessed via HTTPS, and depending on your stance, is a "low-risk" website. </p>
  
  <p>The application, in its current state, cannot be re-written in such a way as to handle Sessions - to properly implement such a thing would require, essentially, re-writing the entire application. </p>
  
  <h2>The Question</h2>
  
  <p>When suggesting to the-powers-that-be that storing their user's IDs/Passwords in plaintext, in a Cookie, is an extremely bad idea, what <em>real risks</em> are involved, considering the connection is always initiated and manipulated via HTTPS?</p>
  
  <p>For example: is the only obvious way to compromise this information via Physical Access to the machine containing the Cookie? What other real risks exist?</p>