Stealing passwords from McDonald's users
This seems to be a common practice, storing UserIDs, Usernames, etc. in cookies rather than a unique SessionID that can be used to look those things up (and will expire).  I&#x27;m curious as to where people are getting the idea to build things that way.<p>Because it never would have occurred to me to do so.  Or rather, had it occurred, it would have immediately begged the question of &quot;what happens when the user monkeys with their cookie&quot;.  Surely everybody else thinks the same way.<p>If so, how do we end up with this?  Are there really &quot;Teach yourself in 21 Days&quot; books that have examples with this pattern that people are following?<p>Or does everybody just assume that they&#x27;re going to be Facebook with 4000 servers and no way to quickly generate or store or manage or look up those keys for millions of simultaneous users, and that it&#x27;s worth the tradeoff?