joomla/joomla-cms — pull request #2672 by Bakual (2013-12-12 14:07:14+00:00)
Title: Fixing remember me function

### Problem
Because the change to `JCrypt::hasStrongPasswordSupport()` to fix its bugs we currently have a non-working remember-me function

### Solution
In the remember system plugin:
* I removed the reference to this function and always use `JCrypt::timingSafeCompare()` to compare the `$privateKey` from the cookie to the database stored `$token`.

In the joomla user plugin:
* Fixed a typo from 'Coookie' to 'Cookie' (thanks to Leo Lammerink who pointed that out in the JBS google group)
* Storing the encrypted `$cryptedKey` instead of `$privateKey` into the cookie. Here I am a bit unsure how that was supposed to work prior. It probably was broken before?

### Question for security experts
The privateKey (which is just a random string) is encrypted using `JUserHelper::getCryptedPassword()` resulting in the cryptedKey which is now stored both in database and cookie. As far as I understand the system (which is based on http://jaspan.com/improved_persistent_login_cookie_best_practice), the whole encryption isn't needed here and serves no purpose. It's a non-guessable one-time token.
But I may be wrong.