title: Is this a reasonable way to implement 'remember me' functionality
body: <p>If a user logs into the site, and says 'remember me', we get the unique identifier for the user, encrypt this with RijndaelManaged with a keysize of 256 and place this in a httponly cookie with a set expiration of say.. 120 days, the expiration is refreshed each successful request to the server.</p>
  
  <p>Optionally we generate the initialization vector based upon the user agent and part of the ipv4 address (the last two octets).</p>
  
  <p>Obviously theres no real expiration system built into this, the user could technically use this encrypted key forever (given we don't change the server side key)..</p>
  
  <p>I considered the fact that to allow this feature I need to allow the user to be able to bypass the login and give me their unique id (which is a guid), I figured the guid alone was really hard to guess a real users guid, but would leave the site open to attack by botnots generating guids (I've no idea how realistic it is for them to find a legit guid).. so this is why theres encryption where the server knows the encryption key, and optionally the iv is specific to the browser and ip part.</p>
  
  <p>Should I be considering a different approach where the server issues tickets associated to a user, and these tickets would have a known expiration date so the server stays in control of expiration? should I really care about expiration? remember me is remember me after all?</p>
  
  <p>Looking forward to being humbled ;),
  Cheers.</p>