What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

This is absolutely unacceptable.

I logged in to my StackOverflow on a shared work computer. After logging out, no matter what I do, I am automatically logged back in whenever someone visits 'log in'->'Log in with Stack Exchange'

THERE IS NO OPTION TO ENTER LOGIN CREDENTIALS. Just '...' then I'm logged in.

I've looked through all the preferences and found no way to permanently log out. I've cleared cookies and rebooted the browser but the only solution is to restart the computer and wait a few minutes.

I'm all for usability over configuration, but is this for real?

Just thinking of all the computers I've logged in to SO on that could be divulging my private information is unnerving. This could be a massive security problem!

Why on earth would there be an unconditional autologin feature?

Someone bring me to clarity before I melt.

share|improve this question
    
Start a private browser session when using Stack Overflow. Then it won't remember your login. –  juergen d May 6 '13 at 18:22
17  
If I have to privately browse this site to avoid being permanently logged in, that's absurd. –  Silvius May 6 '13 at 18:23
    
@Silvius: Clear your cookies and log out of whatever openid provider. –  staticx May 6 '13 at 18:26
2  
Is keeping users from logging in again after signing out really a useful tradeoff versus compromising the security of anyone who is unaware of this strange policy? –  Silvius May 6 '13 at 18:30
2  
@Silvius Logging out should see you logged out everywhere. If I'm not mistaken even on other devices. If you actually log out and that doesn't happen, there might be something wrong. –  Bart May 6 '13 at 18:45
1  
I can't tell if this is a feature or a bug. Logging out says "This will clear our cookies and log you out on all devices." Obviously, the cookies go nowhere, and I will just be automatically logged in as soon as someone else decides to visit the login page. –  user May 6 '13 at 18:47
    
@Bart- Even if I am logged out everywhere, all someone has to do is click 'Log in with Stack Overflow' and my information is theirs. –  user May 6 '13 at 18:48
1  
@Silvius Just now realized this. Pretty absurd indeed. –  user May 6 '13 at 19:57
3  
@0A0D cookies aren't enough, local storage is also used. –  Shadow Wizard May 6 '13 at 20:49
    
Here's a screencast of this insanity. What is even the point of that "log out" link?! –  romkyns Feb 1 at 21:57
1  
@romkyns You're probably logged into Facebook. Log out of that. Then it should work. –  hichris123 Feb 1 at 22:20
    
I've done it too - BIG PROBLEM! –  Jamie Feb 2 at 13:18

1 Answer 1

To log in via any open id provider (for example facebook, or google) on stackexchange, you have to log into your account at said openid provider first.

So what's the point?

By logging out of StackExchange, you are logged out of stackexchange, but not automatically logged out of your openid provider (and this should never be the case). If you log into StackExchange via google, and log into youtube as well, logging out of stackexchange should not automatically log you out of your email (gmail) or youtube (google+ link) as well.

So how do I really logout then?

The logout button correctly logs you out of stackexchange. From that point on you browse as a guest, until you decide to login again. To prevent yourself from automatically logging in, you have to log out of your openid provider as well. If you don't do that, people on that computer can access your facebook profile or gmail too, as well as any other service you logged into during that session with your open id provider.

TL;DR Log out of every site you logged into, including gmail/facebook etc.

But do I really have to remember every site I quickly logged into?

No, no you don't.

If you are on a shared computer where you can't be sure of your account security, don't enter your credentials ever. Use a dummy account or browse as a guest.

If you are on a shared computer where you trust your credentials won't be stolen, use the privacy mode of your favorite browser: incognito mode for chrome/firefox, inPrivate in Internet Explorer, probably a similar name in other browsers. This mode allows you to browse freely on the internet, but the browsing history is not saved and, more importantly, when you close this browser window, all cookies from that session are deleted too. Since that cookie is required to stay logged in, you'll log out from every site, and anyone else that uses the computer will not be able to log in as you. This is also great if you quickly want to check your email at a friend's place, because private browsing is a complete new session (meaning you can log into your email, even if your friend uses the same email provider). Of course, this method will not protect you against malware on such a computer or a network.

TL;DR Use private browsing modus of your browser AND close the browser completely before leaving the computer.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .