Remix.run Logo
Remix clone Hacker News
new | show | ask | jobsGithub
▲ gunalx a day ago

Your tokens should defiently have expiry times on the range that you would need to login again.

▲londons_explore a day ago | parent [-]

I would prefer a 999 year login cookie.

A well designed browser stores the cookies with similar security to the built in password manager anyway

▲ffsm8 a day ago | parent [-]

That's not true, you need to provide a password to read the passwords saved in the browser whereas cookies can be read without any hassle from the developer tools

Cookies can also be queried programmatically, whereas passwords need to have the users auto fill active and interact with the input element

Most extensions have effectively full access to your cookies, not to your passwords - which is a real attack vector (session exfiltration) which is actively being used by had acteues

There are ofc server set cookies which are not programmatically queryable, but that's not the norm (and they're still visible via the developer tools, so the core statement remains untrue)

▲mmmmbbbhb 20 hours ago | parent | next [-]

> Cookies can also be queried programmatically,

Misleading statement, essentially untrue.

> Most extensions have effectively full access to your cookies

False.

> There are ofc server set cookies which are not programmatically queryable, but that's not the norm

That is the norm for login cookies.

> and they're still visible via the developer tools,

This is irrelevant to the argument.

▲watermelon0 a day ago | parent | prev [-]

I’m quite sure that server set cookies are the norm for authentication, at least where they are set from the server side.