[jbossseam-issues] [JBoss JIRA] Commented: (JBSEAM-863) Remember-Me automatic authentication

[Jack Cox (JIRA)]

    [ http://jira.jboss.com/jira/browse/JBSEAM-863?page=comments#action_12353441 ] 
            
Jack Cox commented on JBSEAM-863:
---------------------------------

I agree, never trust the client, but if a secure hash is used to hash[user+expiry+password] then the password is not kept on the system, instead a non-recoverable version of it is.  If a secure hash (like SHA-256, SHA-1 or MD5 [which has some issues]) is stored in the cookie it would take some extensive work (like searching an answer space that is 2^69 big on SHA-1).  The inclusion of the expiry time in the hash prevents it from being attacked with a dictionary attack because the salt adds sufficient randomness. On average the attacker would need to compute 2^68 secure hashes, that will take a while.

Also, for useful features like site personalization, having the user re-enter their password each time they access the site would greatly detract from the value of the feature. Most people just wouldn't use it.

> Remember-Me automatic authentication
> ------------------------------------
>
>                 Key: JBSEAM-863
>                 URL: http://jira.jboss.com/jira/browse/JBSEAM-863
>             Project: JBoss Seam
>          Issue Type: Feature Request
>          Components: Security
>            Reporter: H T
>             Fix For: 1.1.7.GA
>
>
> Extend the behaviour of Remember-Me to automatically authenticate the user after they have selected the "Remember Me" service rather than have him or her re-enter their password each time.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira