What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and registration process.

In fact, it's so well-integrated that it isn't obvious that you're actually signing in to a "third-party" service. Logging out of a single SE site does not log you out of any other SE site, and does not log you out of the SE OpenID service.

While this approach is generally sane for the common case, it can be very troublesome when you're using a public or shared computer. If you don't know that you're signed in to multiple places, it's hard to actually log out of them. Worse, even if you do know that you're signed in to multiple places, you have to know where the logout link is, and remember that you need to use it.

This is inconvenient at best and a security nightmare at worst.

I have a few suggestions, any one of which can help mitigate this problem:

  1. On SE-OpenID login, offer a "This is a public computer. Log me out after closing my browser." option. This approach is taken by some sites, such as Slashdot, that want to keep the expected "remember me" functionality as the default, while drawing attention to the possible security concerns of using a shared computer.

    This option might actually be the most troublesome. If it's offered for SE-OpenID logins, why not for all of them? It could rapidly become an annoyance to implement and is asking for inconsistent UIs.

  2. Implement network-wide logout, including the SE OpenID service in the things considered "network-wide."

  3. If network-wide logout isn't going to happen any time soon: offer a banner or confirmation page after logging out of a specific SE site with a link that will also log the user out of the SE OpenID mechanism, if that's how they were logged in. This is probably the most simple and straight-forward.

(See also: Stack Exchange OpenID credentials not removed on logout, allowing insecure re-login. I realize that this feature request has some overlap with that question and with the network-wide logout feature request. I believe that it stands alone well enough not to be considered a duplicate.)

share|improve this question
    
I again registered a test account for 'Log in with Stack Exchange'. Disappointingly, after logging out of every (SE family) site, it still lets me log in again merely by button clicks, while I type nothing. After more than a year, clearly the managers of the Stack Exchange network family of websites don't give a hoot about protecting users of shared computers with a truly effective signout. What if some rude person click-logged into and deleted someone's account, thus trashing their vast accumulation of reputation? –  MarkDBlackwell Mar 22 '13 at 17:55

1 Answer 1

It's always going to be inconsistent though, right? If I sign into SE with MyOpenID and then log out of SE, I'm still logged in to MyOpenID (just tested this). Is it worth handling the case where they're only logged in via the Stack Exchange OpenID?

I would argue not. Attempting to handle the user's responsibilities for them will only create a dependence. They'll either not realize that MyOpenID et al. don't work the same way, or get in the habit of not logging out of the SE OpenID and forget that they signed in using a different OpenID this time.

So, I like your third idea best; users should be made aware of the security implications here. It should go beyond your suggestion and remind the user to log out of whatever OpenID they used, not just the SE one. (Edit: I just found Adam Davis also suggested this on the related meta question you link to.)

Being logged in to multiple SE sites is somewhat of a separate issue, to my mind. Perhaps the logged-out page could contain the option to logout network-wide, as well.

(As an aside, logging out logs you out of that site on every browser/device. Impressive, but massively annoying for me. I want to log out of a shared computer without logging out of my secured tablets, phones, and computers :P)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .