Question: I am looking into using Ansible to manage my systems and going through its documentation I found a recommendation to run the Ansible commands on a cloud image rather than my local laptop.

My understanding is that Ansible basically acts like an SSH user to the systems it manages. So wouldn't this recommendation mean that I would be storing authorized keys to all my systems (with sudo-enabled users!) all in a single cloud image?

In other words if that cloud image is ever compromised I am royally screwed.

Is this a correct risk assessment or am I not understanding something?

Answer: 
> 
> I'm working with cookies in PHP for a login script and my friend thinks storing a hashed password in a cookie is bad news.
> 
> 
> 

Your friend is absolutely correct, there is no reason to do this. It's not a matter of staying logged in, it's a matter of needlessly exposing the password hash (side note: please use PHP's [password\_hash](https://php.net/manual/en/function.password-hash.php) function for hashing passwords).

While exposing the password hash over an encrypted connection (you are using HTTPS aren't you?) isn't the end of the world, the real problem is that it indicates to me that you're probably authenticating sessions by comparing the cookie's value against the stored hash. This means you have no way to invalidate session cookies, if the password hash is ever exposed, that's all an attacker needs to access someone's account!

Use PHP's built-in session management, which uses a sufficiently long random value to keep track of users (at least in recent versions, old versions have had problems with this).

To answer your original question of how long sessions should last, it varies wildly. My desktop is indefinitely logged into my Gmail account, but most bank sites expire sessions after 15-30 minutes of inactivity. For a site that doesn't have anything too important, long lasting sessions are fine, though it's good to allow users to see existing sessions on their account and expire them manually.
Allowing user's to remain logged in for less sensitive access is fine like stated, Amazon does it. However, websites like ProtonMail do not allow this option.

> 
> storing a hashed password in a cookie
> 
> 
> 

This I have an issue with, I can only see two methods for this to work:

1. [Pass the hash](https://en.wikipedia.org/wiki/Pass_the_hash)
2. Treating the hash as an authentication token

Both methods are vulnerable. Pass the hash is essentially the equivalent to storing a plain text password within that cookie file. Instead, use the cookie to store an [authentication token](https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach). Many approach the token differently, I will use MD5 for demonstration purposes only, please note that it's a *deprecated* hashing function, and should not be used for confidential information. This is a common base idea for implementing authentication tokens *["md5(salt+username+ip+salt)"](https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach)*. Then you can revoke the session token upon compromise without the need to change the password. Furthermore, you can set the tokens to expire after X days, ensuring old cookie tokens are less likely used to be an attack vector.

People leaving their workstation unlocked is a legitimate concern. You must either use a restrive OS or educate the frontend users about OpSec. Compromised programs accessing and copying the authentication cookies could also pose an issue. And accessing the storage drive (if not using encryption) when powered down. All are legitimate concerns, but training the staff about Operation Security is an important factor.