Take the 2-minute tour ×  I am researching how to implement a
persistent "remember me" type cookie for a site. I was just
wondering is using a GUID for a security token as secure an an
md5 hash of username and password?  share|improve this question
1 Answer 1  up vote 1 down vote accepted  A GUID is more
"secure", because there's no possibility of information
disclosure in a random identifier. Otherwise, were the username
to be known, the password could be extracted using a per-
username rainbow table or a concerted attack since you did not
add salt before hashing. NB: MD5 is a rather weak hash at this
point.  Long story short, if you don't need to store private
information in cookies for really really good reasons, don't.
Use a random token instead.  share|improve this answer So it
would be good practice to use a GUID for a security token in
persistent cookies? –  chobo Jan 29 '12 at 1:34 @chobo Yes,
that's fine. So long as you don't give access to anything based
solely on the cookie... Obviously you can't s