银行如何记住“您的电脑”？
你们中的许多人可能都知道，现在的网上银行有一个安全系统，在您输入密码之前，系统会询问您一些个人问题。 回答完后，您可以选择让银行“记住这台电脑”，这样以后您只需输入密码即可登录。
“记住这台计算机”部分如何工作？ 我知道它不可能是 cookie，因为尽管我清除了所有 cookie，该功能仍然有效。 我认为这可能是通过 IP 地址实现的，但我的拥有动态 IP 的朋友声称这也适用于他（但也许他错了）。 他以为是MAC地址什么的，但我强烈怀疑！ 那么，是否有一个我不清楚的 https-only cookie 的概念？
最后，问题的编程部分：我怎样才能在 PHP 中做类似的事情？
As many of you probably know, online banks nowadays have a security system whereby you are asked some personal questions before you even enter your password. Once you have answered them, you can choose for the bank to "remember this computer" so that in the future you can login by only entering your password.
How does the "remember this computer" part work? I know it cannot be cookies, because the feature still works despite the fact that I clear all of my cookies. I thought it might be by IP address, but my friend with a dynamic IP claims it works for him, too (but maybe he's wrong). He thought it was MAC address or something, but I strongly doubt that! So, is there a concept of https-only cookies that I don't clear?
Finally, the programming part of the question: how can I do something similar myself in, say, PHP?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
MAC地址是可以的。
IP 到物理位置的映射也是一种可能。
用户代理和其他 HTTP 标头对于每台计算机来说也是唯一的。
我正在考虑那些阻止您使用加速下载管理器的网站。 一定有办法的。
MAC address is possible.
IP to physical location mapping is also a possibility.
User agents and other HTTP headers are quiet unique to each of the machines too.
I'm thinking about those websites that prevents you from using an accelerating download managers. There must be a way.
根据所有这些帖子，我得出的结论是（1）这取决于银行，（2）可能涉及不止一项数据，但请参阅（1）。
Based on all these posts, the conclusions that I'm reaching are (1) it depends on the bank and (2) there's probably more than one piece of data that's involved, but see (1).
事实上，他们很可能使用cookie。 他们的另一种选择是使用“flash cookies”（正式称为“本地共享对象"）。 它们与 cookie 类似，都与网站绑定并具有大小上限，但它们由 Flash 播放器维护，因此对任何浏览器工具都是不可见的。
要清除它们（并测试这个理论），您可以使用说明由 Adobe 提供。 另一个漂亮的（或者可能令人担忧的，取决于您的观点）功能是 LSO 存储由所有浏览器共享，因此使用 LSO 您可以识别用户即使他们切换了浏览器（只要他们是以同一用户身份登录）。
In fact they most probably use cookies. An alternative for them would be to use "flash cookies" (officially called "Local Shared Objects"). They are similar to cookies in that they are tied to a website and have an upper size limit, but they are maintained by the flash player, so they are invisible to any browser tools.
To clear them (and test this theory), you can use the instructions provided by Adobe. An other nifty (or maybe worrying, depending on your viewpoint) feature is that the LSO storage is shared by all browsers, so using LSO you can identify users even if they switched browser (as long as they are logged in as the same user).
我感兴趣的银行是美国银行。
我已确认，如果我只清除 cookie 或 LSO，该网站不需要我重新输入信息。 但是，如果我清除了两者，则必须进行额外的身份验证。 因此，这似乎就是我的具体情况的答案！
但感谢大家对其他银行的提醒，以及包括用户代理字符串等可能性。
The particular bank I was interested in is Bank of America.
I have confirmed that if I only clear my cookies or my LSOs, the site does not require me to re-enter info. If, however, I clear both, I had to go through additional authentication. Thus, that appears to be the answer in my particular case!
But thank you all for the heads-up regarding other banks, and possibilities such as including the User-Agent string.
您使用笔记本电脑吗？ 在您删除 cookie 后，如果您从不同的 WiFi 网络访问，它还会记得您吗？ 如果是这样，IP/物理位置映射的可能性极小。
Are you using a laptop? Does it remember you, after you delete your cookies, if you access from a different WiFi network? If so, IP/physical location mapping is highly unlikely.
它可以是 cookie 和 IP 地址记录的组合。
编辑：我刚刚检查了我的银行并清除了cookie。 现在我必须重新输入我的所有信息。
It could be a combination of cookies, and ip address logging.
Edit: I have just checked my bank and cleared the cookies. Now I have to re-enter all of my info.
每次新版本的 Firefox 发布时，我的银行网站都会要求我重新进行身份验证，因此某些网站中肯定存在用户代理字符串组件。
My bank's site makes me re-authenticate every time a new version of Firefox is out, so there's definitely a user-agent string component in some.
闪存文件可以在您的计算机上存储少量数据。 银行也有可能使用这种方法来“记住”您的计算机，但依赖用户拥有（且未禁用）闪存是有风险的。
It is possible for flash files to store a small amount of data on your computer. It's also possible that the bank uses that approach to "remember" your computer, but it's risky to rely on users having (and not having disabled) flash.
我认为这取决于银行。 我的银行确实使用 cookie，因为当我擦除 cookie 时我会丢失它。
I think it depends on the bank. My bank does use a cookie since I lose it when I wipe cookies.
这种会话跟踪很可能是通过结合使用 cookie 和识别当前会话的唯一 ID 以及将该 id 与您用于连接到其服务器的最后一个 IP 地址配对的网站来完成的。 这样，如果 IP 发生变化，但您仍然拥有 cookie，您就会被识别并登录，如果 cookie 不存在，但您的 IP 地址与服务器上保存的 IP 地址相同，那么他们会将您的 cookie 设置为与该 IP 配对的 ID。
确实，第二种可能性很难正确解决。 如果 cookie 丢失，并且您只能显示您的 IP 地址以供识别，那么仅凭该地址登录某人是相当不安全的。 因此，服务器可能会存储有关您的其他信息，LSO 似乎是一个不错的选择，地理 IP 也是如此，但用户代理则不然，因为他们并没有真正透露有关您的任何信息，每个人都使用与您相同版本的同一浏览器有相同的。
顺便说一句，上面已经提到它可以与 MAC 地址一起使用。 我强烈不同意！您的 MAC 地址永远不会到达银行的服务器，因为它们仅用于识别以太网连接的两端，并且要连接到您的银行，您需要从您的计算机建立一堆以太网连接到您的家庭路由器或您的 ISP，然后从那里到您经过的第一个互联网路由器，然后到第二个，等等...每次建立新连接时，每一侧的每台计算机都会提供自己的 MAC 地址。 因此，只有通过交换机或集线器直接连接到您的计算机才能知道您的 MAC 地址，因为路由您的数据包的任何其他设备都会用它们自己的 MAC 地址替换您的 MAC 地址。 只有 IP 地址始终保持不变。
如果 MAC 地址确实一直存在，那将是一场隐私噩梦，因为所有 MAC 地址对于单个设备来说都是唯一的，因此对于一个人来说也是唯一的。
这是一个稍微简化的解释，因为这不是问题的重点，但它似乎有助于澄清看似误解的内容。
This kind of session tracking is very likely to be done using a combination of a cookie with a unique id identifying your current session, and the website pairing that id with the last IP address you used to connect to their server. That way, if the IP changes, but you still have the cookie, you're identified and logged in, and if the cookie is absent but you have the same IP address as the one save on the server, then they set your cookie to the id paired with that IP.
Really, it's that second possibility that is tricky to get right. If the cookie is missing, and you only have your IP address to show for identification, it's quite unsafe to log someone in just based of that. So servers probably store additional info about you, LSO seem like a good choice, geo IP too, but User Agent, not so much because they don't really say anything about you, every body using the same version of the same browser as you has the same.
As an aside, it has been mentioned above that it could work with MAC adresses. I strongly disagree! Your MAC address never reaches your bank's server, as they are only used to identify sides of an Ethernet connection, and to connect to your bank you make a bunch of Ethernet connections: from your computer to your home router, or your ISP, then from there to the first internet router you go through, then to the second, etc... and each time a new connection is made, each machine on each side provide their very own MAC addresses. So your MAC address can only be known to the machines directly connected to you through a switch or hub, because anything else that routes your packets will replace your MAC with their own. Only the IP address stays the same all the way.
If MAC addresses did go all the way, it would be a privacy nightmare, as all MAC addresses are unique to a single device, hence to a single person.
This is a slightly simplified explanation because it's not the point of the question, but it seemed useful to clear what looked like a misunderstanding.