title: Can the user agent be used to tie a cookie to hardware?
body: <p>I help maintain a site that is sold to about 100 clients. We take security pretty seriously and we have a multiple step login process. One part of the process can be skipped if you have already logged in before and choose to get a cookie. When you login again and still have that cookie, that step is skipped. Of course, the value in the cookie is random and different for every user.</p>
  
  <p>My boss wants to make it impossible to copy the cookie to another computer. Of course, I've explained that is not possible, but he still insists it is by requiring the user agent to remain the same.</p>
  
  <blockquote>
    <p>"We can then document that we have a “hardened” cookie that is specific to the user’s hardware and software."</p>
  </blockquote>
  
  <p>Of course, I've explained that spoofing the user agent would be many many times more easy to do than spoofing the cookie value, and compared it to putting a band-aid on a padlock. Not to mention any opportunity you have at copying the cookie would allow you to copy the user agent as well. He doesn't care.</p>
  
  <p>It doesn't bother me to require the same user agent but I have some integrity and a problem working on something being sold with such a lie about its security.</p>
  
  <p>I'm a professional not a grunt. I wouldn't design a bridge that supports one weight when I know will be advertised as supporting a higher weight.</p>
  
  <p>Am I being reasonable?</p>