In #1419, we deferred implementation of these recommendations:

• http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
• http://jaspan.com/improved_persistent_login_cookie_best_practice

which would narrow the window of opportunity for an attacker to exploit a stolen login cookie, and provide a means to warn the victim of a stolen login cookie that has been used.

Notes: plugins/Login/Auth.php would have to accommodate the additional table and SQL required by the above. I recommend considering the requirements of #809 (OAuth) when refactoring.