It is possible to use most login cookies to access an account for a certain time period after it was created, if you find a method of obtaining it from the victim. All this talk of decrypting cookie hashes is unnecessary.