What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

This feature is present in Gmail, but I think it might be useful in such an environment, also. What if we were to have a small box at the bottom of authenticated SO pages that show how many places an account is logged in from - in other words, the number and location (by IP) of open sessions.

This way, we could easily keep track of the security of our account, and if one were to leave their session open on a public computer, a remote sign-off feature would be very useful, too.

What does the community think?

share|improve this question
3  
+1. I think this functionality is brilliant, every website serious about security should do this... –  Wim Nov 8 '09 at 22:40
1  
One hour ago, Jeff marked this status-completed. Yay! @Jeff: how do we use this feature? Where is it? Thanks so much! –  Maxim Zaslavsky May 5 '10 at 2:00
2  
If you click on log out you get an option to either lock out everywhere or just log out the current session. –  Christian May 6 '10 at 10:32

2 Answers 2

up vote 3 down vote accepted

While Jeff does note you already have your last IP available, being able to time-out or remotely-kill another session would be nice.

The dopey way to do this would be to kill the other session as soon as you login from another machine, but for those of us who routinely login from our netbook, desktop, and work .. it'd not be so pleasant :)

Maybe implement an "authorized hardware" list like Apple does with iTunes purchases?

share|improve this answer
3  
What if your imposter nuked your session? –  random Nov 9 '09 at 5:16
1  
@random well, we'd have a Nuke-Session War! Sort of like an edit war, but more... fatal! –  Maxim Zaslavsky Nov 9 '09 at 6:47
    
@random, that was where my thought of auto-killing the previous session when you login again came from –  warren Nov 9 '09 at 10:03
5  
@random: Killing other sessions isn't a problem. You just relogin and kill all other sessions. The attacker couldn't login after that because he doesn't know your password. –  Georg Schölly Nov 9 '09 at 12:52
2  
@gs oh ya, forgot that... and if needed, you could change your openid password too. –  Maxim Zaslavsky Nov 9 '09 at 14:44

You already have the last IP address present on your user account, below the "about me" box (visible only to you)

edit: I implemented a "Log Out Everywhere" button on the log out page. This clears all your sessions universally.

share|improve this answer
    
Yes, but what can you do with this IP address? What if, say, your laptop was stolen (though SO wouldn't be a top priority)? –  Maxim Zaslavsky Nov 10 '09 at 0:17
    
This is different than what the OP asked for. –  Andreas Bonini May 3 '10 at 9:23
    
@kop ah, I see, you're right. Sorry. –  Jeff Atwood May 3 '10 at 10:15
    
thanks for implementing part of the feature, but could we also get a list of recent IP addresses, too (just like Gmail has)? This way, we can easily detect unexpected usage of our account. –  Maxim Zaslavsky May 6 '10 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .