Secure ‘Remember Me’ Logins

TL;DR

Permanently logged-in accounts can be secure, but require careful implementation. The risk comes from stolen cookies or compromised devices. Use strong authentication methods (like multi-factor), short cookie lifetimes with refresh tokens, and regularly review security settings.

Understanding the Risk

When you tick ‘Remember Me’, a website usually creates a special file (a cookie) on your computer that tells the site you’ve already logged in. This avoids re-entering your password every time. The problem? If someone gets hold of that cookie, they can pretend to be you without needing your password.

How to Make ‘Remember Me’ More Secure

1. Use Strong Authentication: Multi-factor authentication (MFA) is the biggest improvement. Even if a cookie is stolen, attackers need a second factor (like a code from your phone) to log in.
   • Consider SMS codes, authenticator apps (Google Authenticator, Authy), or security keys (YubiKey).
2. Short Cookie Lifetimes: Don’t let cookies last forever. A shorter lifetime means a stolen cookie is useful for less time.
   • Implement refresh tokens alongside access tokens. Access tokens have short lifespans, and are refreshed using the longer-lived (but still limited) refresh token.
   • Example configuration in Python/Flask:

     from flask import Flask, session, redirect, url_for
     app = Flask(__name__)
     app.secret_key = 'your_secret_key'
     @app.route('/login')
     def login():
       # ... authentication logic...
       session['access_token'] = generate_access_token()
       session['refresh_token'] = generate_refresh_token()
       return redirect(url_for('home'))
     

3. HTTPOnly and Secure Flags: These cookie settings are crucial.
   • HTTPOnly: Prevents JavaScript from accessing the cookie, reducing the risk of cross-site scripting (XSS) attacks.
   • Secure: Ensures the cookie is only sent over HTTPS connections, protecting it from eavesdropping.
   • Example setting in a web server configuration (Apache):

     Set-Cookie: remember_me=value; HttpOnly; Secure

4. IP Address Binding (Use with Caution): Some systems tie the cookie to the IP address that logged in. If someone logs in from a different IP, the cookie is invalidated.
   • This can cause problems for users who change IPs frequently (e.g., mobile users).
5. User Agent Binding (Use with Caution): Similar to IP address binding, but uses the browser’s user agent string.
   • Also prone to issues as user agents can change.
6. Regular Security Reviews: Check your code and server configuration for vulnerabilities regularly.
   • Automated vulnerability scanners can help identify potential weaknesses.
7. Account Activity Monitoring: Log login attempts (successful and failed) to detect suspicious activity.
   • Alert users if a login occurs from an unusual location or device.

What Users Can Do

1. Keep Your Devices Secure: Use strong passwords, keep your operating system and software up to date, and install anti-virus software.
2. Be Careful with Public Wi-Fi: Avoid logging into sensitive accounts on unsecured public networks.
3. Clear Cookies Regularly: Periodically clear your browser cookies.