I am working on a webapp that uses localStorage alone (http://JonathanHayward.com/calendar-todo) to allow the user to create a server account and have things synced over HTTPS to the server so that the webapp is not chained to a single computer.
I'm running into a bit of a brick wall on one security piece. Storing the plaintext, unencrypted cookie is a red flag, but I'm having trouble making an arrangement that does not look isomorphic to storing an unencrypted cookie. If I store a hash of the password plus a secret, only my server may be able to generate an accepted cookie, but someone who accesses the cookie might as well have the plain text password. The best I've been able to think of is to add the ISO8601 expiration date to the secret and password, and then have the server compare it against hashes computed from today to n-1 days in the future. And at that point I have what looks like a plaintext copy of the password that's only good for so long... better, but not that much better.
What's the best way to make a cookie that is seamless from a user perspective and as useless to a cracker as feasible?