How safe is "trust this computer" option for websites?

Question

Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the computer/browser was previously marked as trusted). I'm having trouble to find more information about the subject, in particular on how to implement it securely, if possible at all.

(Note: I refer specifically to general-purpose sites, that rely on nothing special beyond the browsers' capabilities. My bank site for instance uses its own security module (using either Java or ActiveX), but that's beyond the scope of this question.)

Assumptions:

• The computer to be marked as trusted is indeed only used by trusted people, and reasonable measures are taken to keep it malware-free.
• SSL is used to communicate to the site.

Questions:

1. From what I could make of it, a cookie is used to store some arbitrary shared secret between the browser and the site. Is that all? Or does it employ some unique (an un-forgeable) way of uniquely identifying that particular computer or device?

   • In case it's really arbitrary, what properties does it need to be resistant to collisions and/or forgery? (length, randomness, ...)

2. Should the state of "trusted" expire at some point? Or is it enough to offer means to revoke it on demand, in case the user believes the computer/device was compromised?

3. Does it actually add any increased security? Using Google example again, I noticed it periodically requests me to authenticate again (using only username/password though). What's the reasoning behind this?

   • If it assumes the computer is still trusted, couldn't it just keep me authenticated forever?
   • If OTOH it assumes a malicious user might be using it, shouldn't it request a full authentication instead? (i.e. why it assumes just the password is enough? does it consider the computer itself to be the second factor?)

   I understand that, generally speaking, when the convenience goes up the security goes down. My doubt is whether or not this option defeats the purpose of two factor authentication, or it's indeed a reasonable compromise.

Answer 1

Yes, the "remember me"/"trust this computer" option is safe to use, as long as you trust everyone else who might have access to your computer, and as long as it is implemented correctly.

It is generally implemented using a persistent cookie. The cookie contains a random, unguessable token that identifies you securely. If the website is implemented properly, it is sent over SSL and the cookie is marked secure. However, many websites omit this step and send it over non-SSL connections (which is insecure if you ever use your computer over an insecure communication medium, e.g., over an insecure Wifi link) or forget to add the secure flag to the cookie (which is not secure against an active man-in-the-middle attack if you are using an insecure Wifi link).

This cookie can optionally have an expiration date, or can be expired server-side. That's up to the web server. Probably there is no great need to expire it, but you could expire it if it makes you feel more comfortable.

This feature adds a great deal of convenience, as it spares you from having to go through certain authentication steps. The exact details of the security/convenience tradeoff and the security benefits will depend upon exactly how a particular web site uses the "remember me" feature, and cannot be answered generically in the abstract.

For instance, many websites may use the "remember me" feature so that you will be automatically logged in every time you visit from this same computer, without needing to type in your password. That's convenient. It also means you can reasonably choose a longer password: since you rarely have to enter in the password, you can make it as long as you want without worrying about the inconvenience of trying to memorize or type in the password. So, in some sense, this does provide some security benefits.