In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and registration process.
In fact, it's so well-integrated that it isn't obvious that you're actually signing in to a "third-party" service. Logging out of a single SE site does not log you out of any other SE site, and does not log you out of the SE OpenID service.
While this approach is generally sane for the common case, it can be very troublesome when you're using a public or shared computer. If you don't know that you're signed in to multiple places, it's hard to actually log out of them. Worse, even if you do know that you're signed in to multiple places, you have to know where the logout link is, and remember that you need to use it.
This is inconvenient at best and a security nightmare at worst.
I have a few suggestions, any one of which can help mitigate this problem:
On SE-OpenID login, offer a "This is a public computer. Log me out after closing my browser." option. This approach is taken by some sites, such as Slashdot, that want to keep the expected "remember me" functionality as the default, while drawing attention to the possible security concerns of using a shared computer.
This option might actually be the most troublesome. If it's offered for SE-OpenID logins, why not for all of them? It could rapidly become an annoyance to implement and is asking for inconsistent UIs.
Implement network-wide logout, including the SE OpenID service in the things considered "network-wide."
- If network-wide logout isn't going to happen any time soon: offer a banner or confirmation page after logging out of a specific SE site with a link that will also log the user out of the SE OpenID mechanism, if that's how they were logged in. This is probably the most simple and straight-forward.
(See also: Stack Exchange OpenID credentials not removed on logout, allowing insecure re-login. I realize that this feature request has some overlap with that question and with the network-wide logout feature request. I believe that it stands alone well enough not to be considered a duplicate.)