[Bug] Insecure handling of cookies

[gechoto]

Checklist (Your issue will be automatically closed if you delete this part)

• I make sure that there are no existing issues - open or closed - which I could contribute my information to.
• I understand that issues with limited impact, such as those occurring on specific devices or under specific network conditions, will not be fixed.
• I am able to reproduce the bug with the latest version given here: CLICK THIS LINK.
• I have attached the error report in the issue.

Describe the bug

Hi, in your YtdlpHelper:
https://codeberg.org/NullPointerException/PipePipeClient/src/branch/dev/app/src/main/java/org/schabi/newpipe/util/YtdlpHelper.java

You call yt-dlp with the option --no-check-certificate and also send cookies at the same time.
Sending cookies over an insecure connection sounds like a very bad idea.

Why was the --no-check-certificate option added?
Can it be removed?

[InfinityLoop1308]

Users should not be blocked from using this app in any network environment. The risks of using insecure connections should be borne by the users rather than being prohibited.
Perhaps an advanced option could be added to configure this but I don't think it has a high priority.

[gechoto]

Users should not be blocked from using this app in any network environment.

I get the point but I think this should be optional, disabled by default and there should be a big warning when enabling it.

The risks of using insecure connections should be borne by the users rather than being prohibited.

If they choose to, yes. However most users don't know what they do and just expect software to be smart enough to keep them safe.

Perhaps an advanced option could be added to configure this but I don't think it has a high priority.

I think this is a must have when offering such a behavior.

Security is important - especially with peoples Google accounts which contain a lot more than just YT stuff.

If anything leaks this can lead to serious damage because Google accounts can contain a lot of private information like:

• billing info
• home address
• location history
• contacts
• calendar
• full name
• birth date
• cloud data (private photos & documents)
• ...

IMO security should have a very high priority when handling such data.

[InfinityLoop1308]

Fixed in latest build.