In this case the issue is specific to asp.net 2.0 forms authentication cookies, so any site that doesn't use asp.net 2.0 doesn't have the problem, and asp.net 2.0 sites that use other authentication methods such as passport/liveid/openid/ldap etc. don't have the problem. Other sites get around this by building in custom code to reevaluate the user credentials at key points e.g. at the point of purchase or whilst reviewing past purchase records etc. Finally,most sites do not allow you to post text that get's stored e.g. they only allow you to browse and purchase, and if you do enter text it's items such as your own creditcard details which are not echoed back onto the screen. Sites that operate bulletin boards, forums, blogs etc, which allow users to post text/html etc. are targets for hackers who can use these areas to try XSS attacks e.g. this site had a succesful XSS hack a number of months back, but due to the low expiration time, vigilant users, and the httponly protection built into the core, only a dozen or so accounts were exploited, rather than much more. On this basis alone I would not be keen on increasing the timeout.

Cathal

Cathal,

I'm wondering if there's anyway a 'secure' cookie can be used like my bank does? Granted, right now they only use it for Card #'s, but I'm assuming it could be used with the password as well? Though I'm not sure what language they use for their website:

https://www.rbcroyalbank.com/onlinebanking/remember_my_card/about.html

Just throwing that out there...

I think this is a great example of a development community being overcome by their sense of security obligation.

Getting back to the fundamentals, some could say that an advertised feature "Remembering Login" is broke, crippled, non-functional... I prefer to say it simply fails to meet expectations.

If the concern then is risk, this risk needs to be shouldered by hosters... the dev community is only getting in the way by trying to shoulder this responsibility for hosters, and I believe for many, the choosen course of action has fallen short of what many hosters would like to have.

Thats my 2 cents. I personally find the current scheme annoying as heck.

Serious DKP modules for serious DNN gaming communities.