Login Remember Me

[sathiyavathi]

Hello, I am creating a 'remember me' feature for my login that allows the user to only have to login once.

At the moment I store the username and password in a cookie, the password is encrypted with MD5 but that's hardly secure. Anyone could view the cookie and obtain their username and password.

How can I make this more secure? I did read somewhere about storing a session ID as a cookie instead?

Sathiyavathi
Web designing company

[sweetyneya]

using Ubuntu 12.04b

Netbeans 7.0.1
Java 1.6.0_24
OpenJDK Client VM 20.0-b12

even in my php projects, i can use the ENTER key in non .php / smarty (.tpl ) files (css, js, html). Just not PHP & TPL files.

[sweetyneya]

Hashing the username, password and secure code together and storing in cookie would be fine because if the cookies get stolen from the computer they are on then thats not your security problem. You have secured the details within a hash etc so you have done your bit.

If the computer gets hacked and the cookies are stolen then its the users own risk to there own system and not yours. Its only like getting hacked and someone finds a file with all your username and passwords stored in there. You have to contact all your accounts and tell them etc and change the user/pass etc.

Try not to think about it too deeply as the user has to take responsibility also for their own security

starting from hashing

Hashing the username, password and secure code together and storing in cookie would be fine because if the cookies get stolen from the computer they are on then thats not your security problem. You have secured the details within a hash etc so you have done your bit.

If the computer gets hacked and the cookies are stolen then its the users own risk to there own system and not yours. Its only like getting hacked and someone finds a file with all your username and passwords stored in there. You have to contact all your accounts and tell them etc and change the user/pass etc.

Try not to think about it too deeply as the user has to take responsibility also for their own security

[sweetyneya]

Sorry above answer is wrong sathiyavathi this only correct please try this solution

Hashing the username, password and secure code together and storing in cookie would be fine because if the cookies get stolen from the computer they are on then thats not your security problem. You have secured the details within a hash etc so you have done your bit.

If the computer gets hacked and the cookies are stolen then its the users own risk to there own system and not yours. Its only like getting hacked and someone finds a file with all your username and passwords stored in there. You have to contact all your accounts and tell them etc and change the user/pass etc.

Try not to think about it too deeply as the user has to take responsibility also for their own security
starting from hashing
Hashing the username, password and secure code together and storing in cookie would be fine because if the cookies get stolen from the computer they are on then thats not your security problem. You have secured the details within a hash etc so you have done your bit.

If the computer gets hacked and the cookies are stolen then its the users own risk to there own system and not yours. Its only like getting hacked and someone finds a file with all your username and passwords stored in there. You have to contact all your accounts and tell them etc and change the user/pass etc.

Try not to think about it too deeply as the user has to take responsibility also for their own security

[sathiyavathi]

hi sweety can you explain more

[Wynder]

sathiyavathi;11004730 wrote:

hi sweety can you explain more

He's saying that, instead of just hashing the password:

md($password);

Instead, concatenate the username and password together and hash that... or, even better, add in a secret phrase that's constant.

$secret = "Th1$i$4$3cr3tPhr4$3";

md5($username . $secret . $password);

Another alternative is creating a random hash and storing that hash both in a cookie on the users' machine and in your database so you can check against the hash.