« first day (2080 days earlier)      last day (2854 days later) » 

11:02 PM
@Shafizadeh it's related to the article linked above
 
@tereško ah .. I will take a look at it
@tereško You know, I don't like to talk about it .. That's because I cannot defend of that rule. Each country has some rules which aren't reasonable for other people.
 
yeha , you better dont :)
 
What's the meaning of "salt" in this? Is that a random token?
md5(salt+username+ip+salt)
 
yes
though, I am not sure where that exact bit would be used for
 
@tereško cookie ..! I'm trying to keep my website's users logged. So I need to create a cookie and both save it into database and user's device
Well my second question, Ca I use user's password into that cookie? like this:
md5(username+password)
Note: I think ip and salt are redundant.
 
11:11 PM
@Shafizadeh if you want to do it correctly, read this: paragonie.com/blog/2015/04/…
 
@tereško interesting .. I seen that before. But I believe that's wrong. Because I want this: when user changes his password, then his account should be log-out from all devices. (exactly what google does)
So I need a cookie based on the user's password
 
nope
 
why not?
 
you seem have got the wrong impression about login/remember cookies
the point of them is to avoid to cost of hashing
(a proper bcrypt hash takes like 0.2-0.5s)
 
Has hashing a heavy cost?
 
11:16 PM
depends on the hash
 
sha512
 
no, not really, but it's not supposed to be used for hashing passwords
 
ok, suppose you don't access your computer and you borrow mine, and you do login into your stackoverflow accout (by my laptop). and then you forget to do log-out. and you leave me. How can you log out from my laptop?
 
preferably, I would go in my account settings, to the "active logins" section and log the account out remotely (by invalidating a specific cookie)
 
oh .. is there such a option !!
 
11:20 PM
I dont think there is :(
 
:-)
well there can be a good case:
cookie should be based on the password
in this case, when you change your password, then you will log out from everywhere
But I don't know why all professional programmers tell me don't store user's password into cookie :-( so I'm confused
 
because you shouldnt
 
well is my idea bad? (log-outing automatically when you change your password)
 
login-cookie will not be hashed using crypto-safe hashing algorithm
 
@tereško ok I hash it .. what's the problem ?
 
11:24 PM
stop and listen for a while
 
passwords stores using cryptographically secure hashing algorithms, like BCrypt
 
correct
 
when you log in, you get a cookie
this cookie should never contain any information
 
wait please, what that cookie made of ?
 
11:27 PM
instead it should be just a string that is associated with a specific account
3 mins ago, by tereško
stop and listen for a while
 
alright
 
basically, you have table in DB, where you have account IDs and cookie values
when you need to log out a user, you just remove the cookie from this registry
now .. any questions, @Shafizadeh ?
 
all fine
just one thing: what do you mean "a string that is associated with a specific account"? It means that string should be always fixed? or it can be change sometimes?
 
yes, it should change
but "when" depends on your particular implementation
 
@tereško well it makes not sense
you login into your laptop, and then login into your mobile .. is the cookie of both of them different?
 
11:33 PM
yes
 
:-)
I think I'm missing something
well should I store two (or multiple) different cookies for one person?
 
depends
do you want to let the person log in from multiple devices or restrict it to one-login-per-account
 
@tereško on what? (also I have just one column into database named "cookie", So I can just store one cookie for each user)
@tereško no no there isn't any restrict, I want user can log in into multiple devices
brb
 
then you need to store multiple cookies
 

« first day (2080 days earlier)      last day (2854 days later) »