39

This has been brought up many times before,

and I think it is not getting enough attention.

Hundreds, if not thousands of accounts are completely available to passersby, unbeknownst to the account owners because the details of auto-login are stored in local storage on devices they don't own. My account alone is probably still saved on three+ multi-user/public computers I've used before I realized my account details were saved on the device.

We have one Mac for development at work, and when someone wants to use StackExchange on that Mac (without logging into my account unannounced), they have to open Firebug, logout, delete all local data, refresh, delete all local data, and then log in to their account. How many people have failed to notice this and had their accounts basically hardwired to a device?

It sure is helpful if you have one account that is only ever used on one device, but I can't see any sense in having this feature considering a lot of us use many different devices. Smoothie King customers and the patrons of the public library do not need full access to my Stack Overflow account and information. Thankfully this site does not store personal or financial data.

A screen recording of my concerns: http://youtu.be/QqkMWIVjMWg

Improve this question
14
  • 2
    So what's your proposal? So far you've only explained that you don't like the current behavior.
    – Servy
    Commented Jul 10, 2013 at 17:02
  • 16
    I was waiting for a debate to come of this so I could understand the counter argument, but with the limited knowledge I have- remove functionality to save account details (or anything) to HTML5 local storage and rely on cookies only, which are to be completely cleared on logout (which I think they already are). Whatever it takes so I can feel comfortable logging in to Stack Exchange sites from computers other than my main personal device. I find it ridiculous that I have to be paranoid about fully logging out of a web service in 2013.
    – user
    Commented Jul 10, 2013 at 17:05
  • 2
    Why won't they just log you out and then log back in with their own credentials?
    – raam86
    Commented Jul 10, 2013 at 17:24
  • 16
    Glad you asked. Because if you don't do the Firebug routine I mentioned in my post, clicking "log in" skips the chance to enter credentials, grabs your authentication from local data, and logs you in. At no point do you have to option to specify what account you wish to enter.
    – user
    Commented Jul 10, 2013 at 17:26
  • @user That's odd. It doesn't behave that way for me. When I log out and try to log back in (I have a Stack Exchange ID) it asks me for my email and password.
    – user200500
    Commented Jul 10, 2013 at 17:38
  • 1
    The log out button should de-authenticate you everywhere. I don't have this problem. I'm using a Google OpenID account.
    – user206222
    Commented Jul 10, 2013 at 17:39
  • [Asad] I use a Stack Exchange ID, too. [Emrakul] Apparently, it only clears cookies. HTML local storage is different, and unaffected. In the process of screen capturing my problem.
    – user
    Commented Jul 10, 2013 at 17:41
  • 1
    Weird. It worked a second ago. Once I tried logging out -> in a second time, it logs me in automatically. Not sure if this is a time based thing? Edit: Alright, this is almost definitely a bug. Logging out doesn't log me out site-wide anymore, even though I'm almost certain that is the expected behavior.
    – user200500
    Commented Jul 10, 2013 at 17:41
  • 1
    If it deauths everywhere then it's definitely not just clearing cookies; that can't be done remotely. It generates a new token. Still, that doesn't preclude the option of the storage of local credentials, which I find... disconcerting.
    – user206222
    Commented Jul 10, 2013 at 17:44
  • 3
    @EmrakultheAeonsTorn That's the odd part. Sometimes it does de-auth everywhere and sometimes it doesn't. For example, when I logged out on Meta just now, I found I was still logged in on Stack Overflow.
    – user200500
    Commented Jul 10, 2013 at 17:47
  • 3
    @Asad I have tested, and I concur.
    – user206222
    Commented Jul 10, 2013 at 18:06
  • Upload my experience to YouTube (and then spent 20 minutes deleting the Google+, Picasa, and Blogger accounts that were generated for me... grunt) youtu.be/QqkMWIVjMWg
    – user
    Commented Jul 10, 2013 at 18:10
  • 1
    Also note: stackoverflow.com/users/logout/global does not change the effects.
    – user
    Commented Jul 10, 2013 at 18:23
  • Related: Tell me how to log out of Stack Exchange OpenID
    – This_is_NOT_a_forum
    Commented Jan 3, 2018 at 14:11

1 Answer 1

Reset to default
19

Well, first off: a couple of those links are to old behaviors or bugs that no longer exist (for instance, you cannot log off of just a single site anymore). If you find a bug in this, report it - but first verify that it's actually a bug (read on)...

See, the behavior you're describing isn't related to the use of local storage, since that is already cleared when you log off...

...It's because you're actually logged in on two separate sites. And you're only logging out of one.

  • If you log in using a Stack Exchange OpenID, you have to log out of SE OpenID as well. (If that link gives you a "page not found" page, then you're already logged out)

  • If you log in using Google, you have to log out of Google as well.

  • If you log in using Facebook...

You get the picture.

The fact that most folks don't realize this is one of the big ongoing problems with most major "single signon" systems. Even if we're able to solve this for our own SE OpenID someday, the majority of SE users actually authenticate using Google - which they'll still be logged into even after logging out of Stack Exchange. That's just how it works.

Improve this answer
13
  • 13
    P.S.: on a shared computer, you're nuts if you're not already using "incognito mode" for any logins that aren't meant to be shared with the rest of the team.
    – Shog9 Mod
    Commented Jul 10, 2013 at 19:12
  • 1
    But I did that. I logged out of Meta, then SE OpenID at the link you provided, but a) I'm still logged in to all the other SE sites I use b) it doesn't ask me my credentials when I log back in to the one site it did log me out of (this only happens sometimes). Either I'm missing something major, or this is a bug.
    – user200500
    Commented Jul 10, 2013 at 19:54
  • Either way, a) has to be a bug, because Jarrod recently marked a network wide logout feature request as status-completed.
    – user200500
    Commented Jul 10, 2013 at 19:56
  • If it's marked status-completed and it's not working as described, then that's a bug, @Asad.
    – Shog9 Mod
    Commented Jul 10, 2013 at 20:14
  • I'm not going to argue with the decisions of the designers/engineers here, but I really think the steps to log out should be completely obvious and redundant so people don't have to go out of their way doing things like 'incognito mode' or manually log out of every subsite just to achieve expected functionality. This is a global multi-centi-million dollar company. When I enroll in its services, I expect minor details like security on public machines to be covered, or at least explained verbosely.
    – user
    Commented Jul 11, 2013 at 22:30
  • 3
    My proposition to SE: on the logout page, explain the details of logging out completely or provide a 'log the f*** out' button. Even understanding the details you've provided, I will probably never feel comfortable logging in to SE on anything but my own machine.
    – user
    Commented Jul 11, 2013 at 22:33
  • @user: SE is not responsible for the fact that you don't know how to use a public computer properly. Do you also leave your internet banking logged in at an internet cafe, having clicked "Yes! Save my password!" and then blame the bank for your error?
    – Lightness Races in Orbit
    Commented Jul 18, 2013 at 9:29
  • 3
    @LightnessRacesinOrbit when was I given the option to click "Automatically login on this account for the rest of ever"?
    – user
    Commented Jul 18, 2013 at 20:37
  • 1
    The "log out of SE OpenID" link is now broken. I have to google how to log out! I understand that there's a technical reason here, but the utter failure of the SE log-out page to explain that you're not done (as well as how to finish it) is unacceptable.
    – RomanSt
    Commented Feb 1, 2014 at 22:02
  • It's only broken if you're not logged in. I'll clarify that point, @romkyns.
    – Shog9 Mod
    Commented Feb 1, 2014 at 22:09
  • 2
    It would be kind of helpful if the SE logout page actually reminded you about that. Perhaps best would be if the logout button, instead of just taking you back to the site home page, would rather take you to a page telling you which OpenID provider(s) you also need to log out of (and, preferably, included links to do so easily).
    – Ilmari Karonen
    Commented Feb 1, 2014 at 23:06
  • make it a feature-request, @IlmariKaronen
    – Shog9 Mod
    Commented Feb 1, 2014 at 23:08
  • @Shog9: Done.
    – Ilmari Karonen
    Commented Feb 5, 2014 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .