Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented.

My initial assumption would be that it is implemented using an (ip-locked?) cookie on the users system.

This would however seem to drastically weaken security, since if the cookie is stolen, 2fa is essentially defeated (especially if a login-cookie is also stolen).

Any ideas?

share|improve this question

3 Answers 3

Pinning the cookie to the IP is not practical. Imagine a mobile phone that is constantly switching networks.

I heard about pinning the cookie to the SSL session keys in high security applications. The server would allow a specific cookie only if it comes over the specific SSL session that was used to initiate that cookie.

A different way of making the cookie unusable on a different computer is fingerprinting the original computer. The combination of, OS, browser, screen resolution, installed addons, can form a unique fingerprint that identifies one computer.

When Heartbleed hit and session cookies were exposed, a lot of second factor authentication became useless and the "remember me" worsen the problem because cookies did not expire at the end of a session.

The "remember me" functionality is for convenience. Convenience is almost always at odds with security. Imagine using voice recognition in your office to conveniently input passwords and the second factor. Multi factor decreases convenience and increases security.

In fact, multi factor authentication asks for multiple inputs from the user while the "remember me" is used to ask for less inputs. You are asking for something that increases security and convenience. That is where research into new authentication is currently applied. Biometrics, personal devices and other technology is working toward that goal.

  • Services la LastPass and KeyPass can provide the illusion of the "remember me" and still have heightened security.
  • Google is working on a ring and a technology that uses your smartphone and inaudible sound to authenticate the user.
  • YibiKey is a hardware device that can eliminate remembering and typing of passwords.
share|improve this answer

You can see from many sites that it's implemented with cookies; I've seen it implemented in other ways (not to be cryptic - on one site I'm still remembered even when using other browser profiles I suspect Flash Local Storage or bad fingerprinting).

There may be other methods of fingerprinting to protect against copying cookies. Much like you you mentioned with IP addresses, though unlikely as IPs can be different legitimately, especially in corporate environments which may have multiple external IPs and a NAT with no guarantees that your external IP is static for new connections.

You can test cookie storage yourself by exporting cookies on one computer, importing them on another and attempting to log in.

Alternatively, you can also use a tool such as Fiddler to act as a proxy; you can then modify requests to see what is and is not relevant to remembering your authenticated state. This will allow you to either simulate copied cookies, or with a set of copied cookies simulate the original machine.

share|improve this answer

In addition to cookies, this can be easily implemented server side as well. Sometimes users reject or delete cookies so server side methods can be helpful.

Either way, you generally take note of a number of variables such as:

  • IP Address
  • User ID
  • Some form of secure token (indicating that their login was successful)

These can be stored, one-way hashed, in a database table and each access to the site runs a function that reproduces the hash checks it against the database table and returns true or false depending on whether the user is authenticated.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.