If the policy is in place to protect the admins, then it follows, ergo, that admins, being uber concerned with protecting their cookies, could merely not check "remember me" and the point becomes moot, no? I guess I am of the opinion that the goal of any site should be to improve the user experiance, not to erect artifical barriers to entry and not to make it more difficult than most every other site on the internet to enjoy.

I guess it wouldn't be so bad if half the banner ads that display on the login page didn't trigger a series of SSL popups that had to be cleared, too...it's like work logging into DNN multiple times.

actually the issue is with asp.net 2.0, rather than dotnetnuke (I explained a little about this @ http://www.dotnetnuke.com/Community/Blogs/tabid/825/EntryID/233/Default.aspx -i could go into a very long explanation if necessary but basically Microsoft made a very stupid decision by tying the timeout for temporary and persistent cookies into the same value). In essence, if you're using forms authentication, then the cookie lifespan is determined by the value of the timeout attribute of the forms node (by default this is set to 60 minutes). If your particular site requires longer, then simply change that to another value eg.604800 would equal one week. We keep the timeout value on dotnetnuke.com low as it's a security best practice, as (due to the poor microsoft design decision) users who don't want temporary cookies have to suffer from a long expiration period to accomodate users who want persistent cookies). Please note, many sites do not allow persistent cookies, in fact I'll be checking in a change shortly to allow host users to remove the "remember me" checkbox.