What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I've been playing around with the new Auto-Login feature since it was released. I'm not particularly fond of it as it seems to err on the side of allowing access, but I think with enough debugging it can work quite well for the masses.

Anyway, there are a couple of issues I'd like to have addressed, because I don't think it's working quite right (or at least not in a way that I think is right):

  1. I use a Google OpenId. Why, when I click Log Out or Log Out Everywhere, am I not logged out of Google as well, when that was the only password I had to put in to log in initially?

    When I return to the same computer, even if Auto-Login wasn't able to log me in automatically, all I have to do is click on the Google OpenId button on the login page to gain access (no password required 99% of the time). This makes no sense to me, and is totally insecure -- what's the point of logging in and logging out if all you have to do the second time is click 2 buttons? Where do I go to fully log out? This is very counterintuitive.

  2. I browse SE sites from both home and work, and I use essentially the same configuration: Firefox 3.6.10 (with NoScript, Firebug and Greasemonkey) everywhere, XP at home, Windows 7 at work. Whenever I'm finished browsing at either location, I use the Log Out Everywhere option (I'm never simultaneously browsing at both locations). Whenever I come home and navigate to a SE site, I'm automatically logged in (!), whereas at work, I'm not (I get situation #1 instead). Why/how does this happen?

I want to be happy with this system, but right now it's really not doing its job, IMO.

share|improve this question
    
It's very buggy. –  Lance Roberts Oct 18 '10 at 23:26

1 Answer 1

up vote 6 down vote accepted

You've got a lot of misconceptions about Global Login and OpenId.

I use a Google OpenId. Why, when I click Log Out or Log Out Everywhere, am I not logged out of Google as well, when that was the only password I had to put in to log in initially?

You're logging out of Stack Overflow (or any other Stack Exchange site), not Google. Why should logging out of Stack Overflow log you out of Google anyway?

That aside, we couldn't do that if we wanted. OpenId doesn't give us any sort of control over your Google account, it just lets Google tell us you are who you say you are (in essence).

To be clear, we don't have your Google password at any point.

... This makes no sense to me, and is totally insecure -- what's the point of logging in and logging out if all you have to do the second time is click 2 buttons?

Google is automatically providing us with your credentials (essentially, a random unique string) because you have authorized it in the past. This is a setting on your Google account. At some point you checked (or failed to uncheck, I forget how it works with Google) a "Don't Ask Me In The Future" option.

You can revoke site authorizations, of course.

I browse SE sites from both home and work, and I use essentially the same configuration: Firefox 3.6.10 (with NoScript, Firebug and Greasemonkey) everywhere, XP at home, Windows 7 at work.

Global Login is 100% JavaScript (at /js/global-login.js mostly). If you're seeing Global Login at both locations you're not running NoScript or you've enabled JavaScript on Stack Overflow.

It's worth noting that JavaScript errors introduced by Greasemonkey scripts can break Global Login (as they can break all JavaScript in the pages they are injected into).

Global Login credentials are actually stored under the StackAuth domain, so disabling scripting there (and not on SO) would cause some, let's say interesting, problems.

share|improve this answer
    
Okay, I understand more about how OpenId works now. At one point when I signed in to Google, I must have said "remember me." I will have to check my NoScript filter at work -- I have stackauth.com allowed at home. Thanks for your help. –  Jon Seigel Oct 19 '10 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .