1

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com.

How secure is it? What factors should I consider when implementing this in my own projects?

2

How secure is it?

If the username is already public information then I don't see a significant risk. An email address should be considered public information in most cases seeing as it must be known to anyone who wishes to use it.

What issues can prevent me from using the same behavior in my own project?

Firstly, I feel in most cases this functionality is better delegated to the web browser. Most modern browsers have a feature to remember form data which the user can enable and disable as they choose.

If you do go ahead and implement it then you should be considerate of how sensitive the information is to threats such as an attacker having access to the client (eg. a shared machine) or physically seeing it while looking over the users shoulder.

These will be minor threats to most users but they will still exist for users on public devices, etc. so obviously you need to give them the option to disable it and avoid remembering anything that would significantly compromise your system if overseen this way.

One interesting case where you might want to implement your own "remember me" scheme is where it significantly conveniences the user to remember the value, but it would be too risky to let the users browser remember it and possibly display it in clear text.

In that case, you display an obfuscated value to the user but remember the true value without displaying it in the UI. You can then use an option such as autocomplete="off" or a randomised field name to prevent the browser from remembering it. This is commonly used by banks for randomly assigned usernames and account numbers which are at high risk of being overseen but aren't easy to remember.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.