It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having to enter their password every time they wanted to access a site that they visit frequently.
Given the following assumptions:
- All traffic is over SSL, so that physical access to the client is required to gain any stored login token
- Passwords are hashed via BCrypt/PBKDF2 before being stored
What are the security implications, if any, of taking the password hash, hashing it again using salted SHA512 and using the result for the persistent login token? Verification of the login token would be by comparing the token against a hash of the password hash.
The reason I'm asking this is that I'm trying to avoid storing a separate token in the database for the persistent login.