Challenge 2 / 2

Because it would keep everyone logged in by default, even on shared or public computers, so someone else could open the site later and still be in your account.

Because it turns off the normal session cookie (PHPSESSID), so Symfony can’t track users correctly, and logins will randomly break.

Because it can make a "stay logged in for a long time" cookie the default, so if that cookie gets copied or stolen, an attacker could stay logged in for months (or even a year) without the user noticing.

Because it makes the remember-me cookie store the user’s real password in the browser, which could be stolen easily.