I propose to raise the default ($wgCookieExpiration) at least to 90 days from current 30. This setting was supposed to combat leakage of logged in sessions by making them expire before before an attacker grabs them. However, cookie expiry does little to stop bad guys and annoys good ones: * Once you've left a public PC without clicking on "log out", your session is already compromised, even making cookies session-only won't help. * If nobody looks specifically for your session, they can stumble upon it accidentally, while browsing the same site as you did. Lowish expiry time can indeed help lessen this possibility, however with Wikipedia's popularity there's pretty solid chance that someone will visit it from a public teminal within hours, not days. Less popular sites are, on the other hand, protected by smaller possibilities of someone looking for them. * MediaWiki provides no way to adjust preferences without having an account, so advice "register and set this or that in 'my preferences'" is pretty popular these days. However, the need to log in every month which is mildly annoying for wiki regulars, may have a drastic effect on casual visitors. "You told me to register and when I did, I had to relogin after a couple of visits!!1"

What's the reason for having the cookie expire at all (or expire in any reasonable timeframe)? I'm not sure I see what security benefits any expiry provides (much less a 30-day one) given the rampant use of password stores in browsers.

Another option would be to add a user preference for cookie expiry, but suggesting the addition of new user preferences usually activates the Aryeh rage machine. :-)

Instead of randomly increasing the cookies lifetime, I think that we should be renewing the cookies if the session has more than eg. 24 hours. That way, you would never need to login again if you browsed the wiki at least once in the last month. Personally, I don't find annoying having to log in once a month. It's the CentralAuth third party cookies (+ firefox behavior) what makes them expire.

This point is debatable:) At least we inform people that they should provide valid emails if they want to reset their passwords.

That would require some effort, and will add another cookie that stores expiry time. A simple increase in time will be a fine solution until a complex scheme is implemented (do we want it at all? more cookies=more bandwidth). Additionally, there's still no good reason to keep expiry time short anyway.

I propose to raise the default ($wgCookieExpiration) at least to 90 days from current 30. This setting was supposed to combat leakage of logged in sessions by making them expire before before an attacker grabs them. However, cookie expiry does little to stop bad guys and annoys good ones: * Once you've left a public PC without clicking on "log out", your session is already compromised, even making cookies session-only won't help. * If nobody looks specifically for your session, they can stumble upon it accidentally, while browsing the same site as you did. Lowish expiry time can indeed help lessen this possibility, however with Wikipedia's popularity there's pretty solid chance that someone will visit it from a public teminal within hours, not days. Less popular sites are, on the other hand, protected by smaller possibilities of someone looking for them. * MediaWiki provides no way to adjust preferences without having an account, so advice "register and set this or that in 'my preferences'" is pretty popular these days. However, the need to log in every month which is mildly annoying for wiki regulars, may have a drastic effect on casual visitors. "You told me to register and when I did, I had to relogin after a couple of visits!!1" Taking this all into account, I see no reason to keep the current default. -- Max Semenik ([[User:MaxSem]]) _______________________________________________ Wikitech-l mailing list Wikitech-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l