You might be interested in Steven Murdoch's paper 'Hardened stateless session cookies'. See this blog post for the paper and some other related links:

http://www.lightbluetouchpaper.org/2008/05/16/hardened-state...

One thing you gotta remember is that that cookie is going to get shoved up to your server with every single request (images, css, ajax, everything). So if you end up putting 2k of stuff in there then it can really add up (esp. given that many clients have asymmetric connection speed). You don't want your tiny ajax requests that load 50 bytes of data sending the equivalent of 4 - 8k upstream because they are all sending a bunch of unnecessary stuff in your cookie. So, yes, it's good - but the key to it is keeping the cookie "slim".

(NB: couldn't see the presentation since I don't have flash, if they covered this, apologies).

Yes, this is why you load images and CSS from a CDN, and you can do JSON+callbacks instead of Ajax onto a big app server somewhere. (There's a gem for Rack, if you're on Ruby, to automatically handle the parenthesization.)

What do you mean by JSON+callbacks?

You promote data to code.

JSON is usually a data format, like {result: 42}. If you wrap that in callback({result: 42}), that's executable javascript code.

Including script tags on your pags via JS, like how the Delicious API / Flickr API / Google Translate & whatnot APIs, all rely on this. Check out http://developer.yahoo.com/common/json.html#callbackparam

No, as it's signed and also will have a timeout long before someone can brute it.

rails comes with cookie sessions by default.