We will have to make this name slightly more complex by adding in something installation specific in order to be able to have several J installations per domain (for example localhost ;-) ) but there is no additional security gain in "hiding" the cookie name further. An attacker would simply take the 2 cookies with weird names, drop the one marked as session cookie and bingo you got the remember me cookie.