про куки файлы — Transcript

Full transcript

1. 0:00Make a video about cookies, and I have
2. 0:02something to tell you about cookies,
3. 0:04and more specifically, about cookies.
4. 0:06There's a lot of cool stuff in there,
5. 0:07really. The basic idea behind cookies
6. 0:09is that a server needs to somehow
7. 0:10distinguish between its users. You
8. 0:13could, of course, differentiate them by
9. 0:15login and password, but to avoid having
10. 0:17to re-enter them every time, you could
11. 0:18simply give them an ID. The ID is
12. 0:21stored on the user's computer, not on
13. 0:24the server. And when the user closes
14. 0:26the site and then reopens it, instead
15. 0:27of entering a password, they'll simply
16. 0:29show this ID saved on their computer.
17. 0:31Essentially, this is a cookie. The site
18. 0:34saves some text in your memory so that
19. 0:35it can later use this text to identify
20. 0:37you. And, of course, giving such files
21. 0:40to the user's computer is a fatal
22. 0:42mistake. Firstly, stealing accounts has
23. 0:45never been easier. Any virus scans your
24. 0:48system, downloads all the cookies, and
25. 0:50sends them to the attacker. The
26. 0:53attacker simply inserts these cookies
27. 0:55into their browser, and no two-factor
28. 0:57authentication or complex ten-character
29. 0:59passwords will help. Your session has
30. 1:02literally been hijacked, and I did this
31. 1:04, of course, for educational purposes,
32. 1:06but it looks like magic. Ctrl + V,
33. 1:08Enter, and you're logged in. But the
34. 1:10fun begins when the website creator
35. 1:12adds some additional information to the
36. 1:15cookies. After all, if you specify not
37. 1:17only the session but also the user's
38. 1:19rights or status in the cookies, you
39. 1:21can significantly reduce the database
40. 1:22load. Let users carry their own
41. 1:24information, right? By the way, our VPN
42. 1:27with Spotik will help you avoid
43. 1:28blocking. Clean IPs for neural networks
44. 1:30, fast servers for games. Bypassing
45. 1:32whitelists and getting three free days
46. 1:33is in this Telegram channel. I'll tell
47. 1:35you about the promo code at the end of
48. 1:36the video. So, some website creators
49. 1:38actually wrote user rights in cookies.
50. 1:41Naturally, such cookies could be edited
51. 1:42and you could become an administrator.
52. 1:44So, to prevent this from happening,
53. 1:46they started signing cookies. That is,
54. 1:48if even one character in a cookie
55. 1:50changes, the signature becomes invalid.
56. 1:52Naturally, the presence of this
57. 1:54signature was stored in the cookies
58. 1:56themselves. It was enough to simply
59. 1:58change the signature algorithm to none
60. 2:00and edit it however you wanted. Of
61. 2:01course, that was a long time ago. Now,
62. 2:03cookies have become much more secure
63. 2:04and all exploits have been closed. But
64. 2:06if you know a wipe coder, you can dig
65. 2:08into the cookies on their website. For
66. 2:10educational purposes, of course.
67. 2:12Cookies are actually cool. They can be
68. 2:13used to create a website without a
69. 2:15database at all. Let the user store all
70. 2:17their data. Here's an idea for a
71. 2:20university project. And if you use a
72. 2:22VPN for three free days, you can use
73. 2:23the promo code CHOPA to get a 15%
74. 2:25discount. You need to go directly to
75. 2:27this channel, not through some bot.
76. 2:29Several fakes have already been created
77. 2:30. Don't fall for it.