0

This question already has an answer here:

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. Meaning, by creating machine tagging mechanism to remember me should invalidate the login associated with a cookie on a different machine.

What is the best way to implement machine tagging when allowing a user to "remember me"?

Also, what information precisely would you use to machine tag? I guess It is not enough that this information be unique; it also has to be unguessable to an adversary,

This question is not referring to understand how best secure the session but looking at long-term / persistent hold with parameters of identifying the user machine characters.

marked as duplicate by AndrolGenhald, Tobi Nary, Rory Alsop Aug 27 '18 at 12:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You didn't really read the question. This question is not referring to understand how best secure the session but looking at long-term / persistent hold with parameters of identifying the user machine characters. – SecQuestionnA Aug 22 '18 at 17:07
  • Actually, the answer addresses your question, but from a different angle. It is saying that implementing machine tagging will not work the way you hope it will. – schroeder Aug 22 '18 at 17:21
1

The problem with asking a machine to identify itself is that it can lie. If an attacker can steal a cookie, there is a good chance that they can also discover any information needed to impersonate that machine.

The only (partial) exception to this is IP addresses, but when you tie a cookie to an IP address you risk annoying users when their IP address changes. Unfortunately, changing IP addresses is quite common for smartphones or laptops, and may even happen regularly for a desktop depending on the ISP. IP addresses can also be shared by multiple users, so this solution isn't 100% effective. This is a trade-off between usability and security, so the decision will depend on the application.

In most cases a cookie with the Secure and HttpOnly flags is sufficient.

Not the answer you're looking for? Browse other questions tagged or ask your own question.