Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 153 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Logging out of the stack exchange sites is a bit of a formality for me. I only log in from the one PC which no-one else has access to. I'm aware that there are ways that people could impersonate me if they really wanted to, but the security level is plenty enough given that no-one would want to.

But I still find it odd that it's increasingly difficult to log out and stay logged out. I'm surprised that anyone who shares a PC, or who's main PC is easily accessible by others, isn't complaining.

Basically, I make a point of doing the "Log Out Everywhere" when I log out of the last stack exchange site - and of then stepping through them to make sure they're logged out. Not from paranoia, but through curiosity - I've always had a certain rate of finding myself logged in when I'm convinced I logged out.

Yet when I return, so long as it's some time later, I always get the "Welcome back" automatic login without my openID or password being requested - at least I have since this new feature was added.

An additional issue - it seems impossible to be logged into one stack exchange site, but to view another (perhaps accidentally due to Googling) without getting logged in, irrespective of whether I want to be logged in to the other site.

My browser is set not to store passwords for anything, so nothing is using that. Quite simply, if someone had access to my PC, they'd only have to select a bookmark to access e.g. Stack Overflow, be logged in as me, and to be able to impersonate me.

What's going on with that?

share|improve this question
In theory, at least, "Log Out Everywhere" should permanently clear all login data associated with your machine—global authentication should be disabled until you log in on at least one SE site. Since it's apparently not working for you, I'm going to say that it might be a bug. – waiwai933 Nov 25 '10 at 7:17
It's only happening since I switched to OpenSUSE 11.3 from Windows XP, but using up-to-date Firefox for both. Possible connection? I can't easily test again on XP - I disabled the modem driver and uninstalled all the antimalware etc. – Steve314 Nov 25 '10 at 7:26
up vote 1 down vote accepted

Not a dupe, sounds like a browser issue with extensions, possibly.

Try running Chrome clean (no extensions) or Firefox Safe Mode and see if you can duplicate; I can't duplicate this in Firefox.

Clicking that button clears HTML 5 Local Storage on that browser. If it does not, something in your browser is interfering.

share|improve this answer
OK - I did the log out everywhere, closed Firefox completely, then restarted in safe mode. I haven't seen a "Welcome back" message since then - but I haven't had to log in either. Flicking through various sites, some were just logged in first time, others took two or three attempts. Note - I really don't have much in the way of add-ons anyway - just noscript and adblock - though noscript could easily be a suspect, of course. Obviously scripts are enabled on stack exchange sites. – Steve314 Nov 25 '10 at 7:48
I lied - I also have the OpenSUSE add-on that get installed by default. – Steve314 Nov 25 '10 at 7:50
Firefox version is 3.6.12 - the about box specifically mentions "Firefox for OpenSUSE" so there may be some OpenSUSE-specific changes? – Steve314 Nov 25 '10 at 7:56
@steve314 noscript will absolutely interfere. – Jeff Atwood Nov 25 '10 at 8:01
Correction - only SuperUser and Meta had me logged back in. I thought I'd been logged in Math and SO, but I must be going nuts. I think when I logged out, the log out everywhere was done for SO and I wasn't logged in to Math, so maybe SuperUser and Meta just didn't log out in the first place? – Steve314 Nov 25 '10 at 8:02
@steve log out everywhere simply clears HTML 5 local storage (network ticket) and the HTTP cookies for the CURRENT site. There is no way one site (eg superuser) can clear HTTP cookies on a different domain (eg stackoverflow). – Jeff Atwood Nov 25 '10 at 8:09
@Jeff - I've confirmed that noscript is the problem (disable it, inc. without safe mode, and everythings fine), but this is strange. I used Firefox with adblock and noscript on Windows for over a year without any of these problems. Probably I've missed something stupid - for the moment accepted, but I'll report back if I figure out what's changed WRT noscript (probably some setting I've missed). – Steve314 Nov 25 '10 at 8:11
@Steve314: This is just a guess for why NoScript may be interfering even though you've enabled scripts on Stack Exchange sites: maybe you need to also allow some OpenID-related scripts. Look at its log/message of what scripts were blocked. – ShreevatsaR Nov 27 '10 at 5:38
@ShreevatsaR - actually, it turns out I'm still getting problems with noscript disabled. As long as Firefox is running, everything behaves as expected - but if I logout, then exit Firefox, then restart Firefox I generally get the "Welcome back" again now. There's obviously some additional condition, but I can't figure out what it is. Actually, I'm not quite clear on what the "Welcome back" is for. If it's not supposed to log you back in when you've logged out, and if no domain is supposed to know what any other domain is doing (see Jeffs last comment) - when is the message supposed to happen? – Steve314 Nov 28 '10 at 2:34
It sounds like your problem (and mine) is with the automatic login: we can't seem to turn the darn thing OFF. Bad security, really. I dread the thought of what would happen if someone were to log in on a public computer. – JPmiaou Feb 28 '11 at 6:11
@jpm use the "log out everywhere" option on the logout page to clear HTML 5 local storage. – Jeff Atwood Feb 28 '11 at 6:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .