Many sites have a "trust this computer" option that allows one to bypass some security measures (ex.: with Google's 2-step authentication enabled, one does not need to enter the phone's code if the computer/browser was previously marked as trusted). I'm having trouble to find more information about the subject, in particular on how to implement it securely, if possible at all.
(Note: I refer specifically to general-purpose sites, that rely on nothing special beyond the browsers' capabilities. My bank site for instance uses its own security module (using either Java or ActiveX), but that's beyond the scope of this question.)
- The computer to be marked as trusted is indeed only used by trusted people, and reasonable measures are taken to keep it malware-free.
- SSL is used to communicate to the site.
From what I could make of it, a cookie is used to store some arbitrary shared secret between the browser and the site. Is that all? Or does it employ some unique (an un-forgeable) way of uniquely identifying that particular computer or device?
- In case it's really arbitrary, what properties does it need to be resistant to collisions and/or forgery? (length, randomness, ...)
Should the state of "trusted" expire at some point? Or is it enough to offer means to revoke it on demand, in case the user believes the computer/device was compromised?
Does it actually add any increased security? Using Google example again, I noticed it periodically requests me to authenticate again (using only username/password though). What's the reasoning behind this?
- If it assumes the computer is still trusted, couldn't it just keep me authenticated forever?
- If OTOH it assumes a malicious user might be using it, shouldn't it request a full authentication instead? (i.e. why it assumes just the password is enough? does it consider the computer itself to be the second factor?)
I understand that, generally speaking, when the convenience goes up the security goes down. My doubt is whether or not this option defeats the purpose of two factor authentication, or it's indeed a reasonable compromise.