I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until today, I was just using the default implementations provided by the ASP.NET authentication system - which I must say, is pretty secure (as long as one does not fiddle with the provided default implementation). But today, I just got curious about the implementation details of this feature. I did some research, and went through a few related articles:
Troy's article basically comes down to the conclusion that, if possible you're better off not implementing this feature at all, as no matter what, despite your best of efforts, you're always going to have to come down to a security related compromise. Similarly, Barry's article, based on Miller, Charles design, he has some very nice strategic steps to minimize the attack surface and complicating the attack vector.
So, coming down to the main point, after going though these articles, one thing that sprung in my mind was,
why are the cookies not signed by the browsers ? Wouldn't it be best if each browser-client (mobile/desktop/whatever), had their own unique GUID kind of thing, which was not to be modified(under any circumstances), and then they can send their GUID to the servers, and the server could then use as the key-value to decrypt/verify any client-side information(cookies/querystrings) ?
Wouldn't this solve the issue of session-hijacking/cookie-hijacking completely, as a cookie from one browser would then be totally useless for another browser ?
Sorry if this sounds naive, but I would really appreciate suggestions and feedbacks on this. Thanks.