Security. Cookies or ?...

Currently, my users have a 10 digit account number that they must enter to authenticate themnselves. I also look at the IP where the transaction is originating, and compare that to a valid range tied to their account. The numbers are "clunky", but effective. I've shied away from cookies because I don't understand them, and I think it might be possible to build a web page to suck out cookie info from a browser (presenting itself as my domain) My users would be particularly vulnerable to that sort of attack, as they are the anti-spam cops. Comments, suggestions, pointers? :) -- www.SpamWhack.com A pre-emptive strike against spam A tornado is a lady whose skirts you do NOT want to look up! Where's dave? http://www.findu.com/cgi-bin/find.cgi?kc6ete-9