Posted by John Nichel on 04/09/05 15:48

trlists@clayst.com wrote:
<snip>
> A couple of people have stated this but I think it is incorrect. For
> one thing the users themselves are very likely to store the password
> there, so why shouldn't you -- with permission of course?

If the user wants to circumvent security measures by storing passwords,
that's their option, but it's the programmer's obligation to keep
his/her app as secure as possible.

> Many sites will do this with a "remember my password and log me in
> automatically" feature. Web-based discussion boards, for example, do
> this routinely and the only security risk is that someone who got
> access to your computer might get access to your account on the board.
> As long as the discussion topics are not sensitive I suspect most
> people using private computers would judge this to be an acceptable
> risk. On the other hand I would never do it (or allow a site to do it)
> for a site where my email account could be accessed, or money could be
> charged. But others might feel their computer is secure enough that
> they are willing to take even those risks.

While 'remember me' is a popular option, it doesn't mean that the site
is storing your password in a cookie. In applications I create, the
password never 'leaves the database'. When the user submits their
login, I'll check the password against what is in the db (after doing
various encrypt methods on it), and that's as far as it goes. If the
login is successful, and the user has a 'remember me' option, I'll
create a unique hash based on a combination of things (like username,
ip, time, random words, etc.), and store that hash in in a temporay
table (as well as in the cookie). When the user comes back, I'll check
that hash, and if successful I'll delete it, and generate a new one for
next visit. And even this type of 'login' may not give the user full
access to their account, as I may ask for the password again if they
want to update some items.

> Like many such questions, to me this is not something that should be
> subject to absolutes but to considered judgment, some on the part of
> the developer and some on the part of the user.

While it is not absolute that you can't store passwords in a cookie, it
is an absolute that you _shouldn't_

--
By-Tor.com
....it's all about the Rush
http://www.by-tor.com

[Back to original message]