[_bfhp]

Are people really unable to imagine alternatives to a "yes/no" debate? Certain websites should never have Remember Me checkboxes and should log you out when you close the tab, like banking websites (mine does have a Remember Me checkbox, for shame). There should be a convenience cost for security, or else you're probably not doing security right. Unless it's Reddit or something, there should be no Remember Me and the cookie should expire shortly or on closing the page.

[inthewind]

Good point. Remember the old browser modal dialogues about sites using cookies? I bet you could ask 10 people and perhaps 1 of those might actually be able to describe what a cookie is. This is a failure from on-line educators and browser manufacturers.

If you could easily identify that a site you were on had cookies stored, and that one was about you being logged in, and it was plain simple to wipe that cookie then I'm sure you'd be happier about that situation. Couple that with a default to have them disabled - until you explicitly lend your browser a little more trust - to prevent ticking those boxes in a public place. And we might all feel a little better about them.

I guess cookies though are a solution to the leave me logged in checkbox. Another technology could be used. I personally hate them as they currently are.

Even key chain programs are difficult to understand. Safari uses user key-chain, Firefox uses it's own profile to store passwords. No consistency and headaches for users.

[jarek]

In my experience, "remember me" on banking sites usually saves only your username/login name. Useful on your personal computers when your bank uses your 16 digit card number for login name.

[_bfhp]

I agree with the above, except I'd replace "Useful" with "Horrifying"

[jarek]

IMVHO, if someone has access to your cookies, you are likely dealing with problems bigger than protecting your bank card number. That implies having access to your files, physical access to the machine, or MITMing the connection to your bank. I can think of worse things that can be done with that level of access.

Maybe I'm missing something.