[Darth Cow]

Originally posted by Stadler

• As for Darth Cow's idea: I've added the md5-hash of $ourtimenow to the cookie "bbcookietime"

Cool . However, the hack still isn't very secure - the MD5 algorithm is known, so someone could change the date and then md5 the changes as well. Now that I think about, you're right that you don't need to save all login time. But I would rather use a variant of md5 to store the date. Checking it to make sure the date still equals the md5($date . "randomstringtochangemd5") would make the system secure, as long as everyone can come up with a constant random string to append to the date for the md5.