dependent on ticket:235
session token is reset from time to time, if a valid session cookie is present. persistent logins, without having username and password in cookie, and without loosing any security or conveniencce.
see shiflett pp69-73
enhancement to shiflett model: is there any reason to not generate a new token for every request?
adamc:
Off the top of my head, the approach I would favor here is shifting from
the passing of Kerberos passwords (even hashed ones, as Mike pointed
out; md5 and even sha-1 are falling victim to Moore's law and some
sophisticated mathematics) around in cookies, to using one-time session
keys. Upon successfully authenticating via Kerberos [ mechanism to be
determined =) ], a session key for the user would be created that allows
access to whatever the user has privileges to access. Effectively, the
session key is a one-off password.
That key would be what's remembered. That way, if the cookie is ever
sniffed, the only thing that's lost is something that temporarily allows
access to this one resource, rather than the compromise of the user's
Onyen account.