“Hack” is a pretty imprecise term, but let me see if I can discern what you mean by it.

I’m guessing you mean something like “log in as me,” in a way that would allow a hacker to see your private information and take actions as you, yes? (You mentioned Facebook, so something like reading private DMs and/or making posts as you would be your concern, yes?)

First off, there are some things about software security that require specialized/professional knowledge to understand, but a lot of software security is things that you can mostly work out for yourself with no “magic” involved.

You said in your original post “without using my password”, but do for sure consider that if your password is “1234” or the word “password” or something similarly easy to guess, that’s definitely one way that hacker could gain access to your accounts without comporomising your computer.

Similarly with your “secret questions” for account recovery. (That feature is usually used let you back into your account if you forget your password.) If your answers are easy to guess, that can (depending how exactly the website acts) be used to gain access to your account.

Cookies are unique identifiers that websites give you to uniquely identify you. Websites can handle requests from thousands of different users in a single second and need to be able to keep track of which requests are for the user “TootSweet” and which are for the user “adrian rodriguez” (and which are for which of the other thousands of users.) When you visit a website and your browser doesn’t give a cookie value, the website assigns you a cookie value (typically a very large number.) Thereafter, your browser will send the cookie value to the website every time your browser sends a message ot the website.

When you log in, the website saves some information on its side saying “all messages with the cookie value 12345678 are for the user ‘adrian rodriguez’.”

So, if you’re logged into a website with the “remember me” feature, that means there’s a cookie value in your browser that the website knows is you. Anyone with that cookie value can access the website as you.

Your browser does its best to make sure that that cookie value isn’t leaked to anyone. It’s supposed to be kept a secret between the website and your browser. And unless the website isn’t following good security practices, the website only assigns very large, random numbers that are very very hard for a hacker to guess.

So in practice, for a hacker to access your accounts as you via your cookies, somehow they’d have to get your cookie value. And that cookie value only exists on your computer and on the website’s computers.

If a hacker was targeting you, they might try to trick you into giving them your cookie value. They’re not terribly easy for a casual user to find, but if a hacker walked you through the process without telling you that they were trying to steal your identity and log in as you, theoretically it could be done. That would involve following some somewhat complex and opaque steps, though. Or a hacker might try to infect your computer with a virus that would go find the cookie values where your browser keeps them and send those cookie values to the hacker. There are some other potential ways they might try to steal your cookie values, but for most users, those are pretty unlikely scenarios where the hacker would probably be walking you through it step-by-step over the phone or some such.

There have been a few times when the account of someone I knew started posting spam messages or some such. I suspect in the significant majority of cases where that’s happened, it’s been because they used a very weak password or there were viruses on their computer or phone.

If that happened to you recently or you’re concerned about that potentially happening to you in the future, changing your passwords (and switching to a password manager like “LastPass” or short of that just picking a very hard-to-guess password and not reusing the same password for multiple accounts), enabling 2-factor authentication, reporting the incident to the website(s) where your account(s) were compromised (if possible), and logging out are probably your best options.

Deleting your cookies regularly can’t hurt, but it doesn’t really do anything other than log you out of all websites. (I’m oversimplifying a little, actually. But not much. It would technically be a little safer to log out of websites when you’re done using them than delete your cookies. Logging out lets the server know to stop thinking that the cookie value number is associated with your account. Deleting your cookies just makes your computer forget the cookie value. If someone already has your cookie value for a particular website, then deleting your cookies won’t do anything to revoke their access. But logging out theoretically might in some circumstances.)

Also, deleting your cookies on your phone won’t do anything about dedicated apps that you’re logged into. So, for instance, if you’re logged into the Facebook Messenger app, deleting your cookies from your browser won’t log you out of your Facebook Messenger app.

One other thing I’ll mention. You asked if providing your email address to a website could allow a hacker to access your accounts. Think to yourself: if you only knew your email address and not your password and you were logged out of an account, could you use just the email address to log in? If the answer is “no”, then chances are the same is true for “hackers.”

Sorry. I went into this post trying to explain things simply, but it’s a complex topic! I hate that there’s an extent to which you do have to be an engineer to understand some of this stuff and make good software security decisions. But there’s definitly also an extent to which you can improve your security without a degree in computer science. I hope some of this has helped at least somewhat.

It somewhat depends on what kind of accounts you mean, and how you define hacking. It’s possible, but here’s the bigger explanation.

Someone who works at Facebook(just an example, could be any company) with the appropriate access could probably look up your account data without using your password or installing a virus. This could be done for legitimate support reasons, or be considered hacking if it’s done against policy.

Someone who hacks a company that you have an account with could potentially get access to the same information again without touching your password or computer. These big leaks happen all the time, they’re the ones you hear about on the news, though they usually don’t get full access to everything. They do not usually get the actual passwords for individual accounts, but could get information like name, birthday, credit card, activity, etc.

There’s also a form of hacking called a Man in the Middle attack, where someone will set up a compromised internet connection (usually wifi) that you then connect to thinking it’s fine. This system can then detect your device connecting to certain companies (again I will use facebook as an example) and will instead take the authentication piece your phone sends, and itself send the data to facebook, then get the authorization token from facebook, and send you a fake one. Then it sits in the middle and everything you do it passes on, so it looks like it’s working fine, but it can also send it’s own requests.

Depends on the type of account, but here are some of the common methods of how this might happen:

• The attacker could be straight up guessing the password. (One possible way to mitigate this: the website can go “wow, 10 failed login attempts from that source. I’m going to ignore all attempts from there for 24 hours.”)
• The attacker could be using previously exposed passwords. (One possible way to mitigate this: The websites should immediately require password reset for all users when that kind of data breach happens. For users: never use same password for multiple different services, certainly never reuse a compromised password even if it’s for a different service. Also: haveibeenpwned.com)
• The attacker, currently using the same network, could hijack the session. (This was a really huge problem back in the day. In this day and age, websites should be using HTTPS, which limits this very much. Still possible if the site doesn’t use HTTPS, and through some other vectors, e.g. malware or hijacked network hardware).

Also: Malware is a really scary big problem in that they’re rarely targeting you specifically. Why do that, when they can million people at the same time and sift through that stolen data for most valuable stuff, right?

Yeah absolutely they can if you’re using poor online security. The most common would be through reused passwords since websites have breaches all the time. This can easily be mitigated with the help of a password manager and 2fa (stick with totp, passkeys and hardware security keys). The second most likely method would be through phishing schemes, where a realistic looking message from a website/app is sent to you and you input your account credentials. AI is also making this much more difficult since realistic sounding voices of loved ones can be used to trick you into sending over your account credentials but that would be more of a targetted attack. You really just need to be aware of what you’re doing, not click on links unless you were expecting them, and double check identifying information from the sender to protect yourself from this. The last method is really a targetted attack and thats social engineering. This is where a scammer calls in to support pretending to be you, with personal information most likely from online breaches, in hopes of gaining your account credentials. You would just really need to rely on your 2fa and the training of support reps to protect you from this. Mostly common with phone carriers so make sure 2fa is enabled there.

Technically it is possible yes but this question is both too specific and too vague to give a proper answer i feel.

A hacker could be exploiting security vulnerabilities in the software/website or employing phishing techniques to trick you into giving access. This way they don’t need a password or virus.

Its also possible that a chunk of your account data got leaked and they have that data rather then full access.

Is there more context to this story?

There’s always packet sniffing but the person would have to have access to the network

Yes

Unless you’re talking about local accounts, remote accounts are inherently remote by definition and additional attack vectors apply.

Yes - “session hijacking”

I heard about a dude who can enter anyone’s Discord in minutes. this information jumped 3 times until getting to me basically. So idk how true it is.

Yeah , I am very well good in accessing accounts mostly social media accounts although there are different methods we work with in regards to access an account,it all depends on how tight the security is .