Return to Answer

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested in mailing list, 'openid-general' by an Andrew Arnott here: http://lists.openid.net/pipermail/openid-general/2009-April/017856.html and by someone else here : http://lists.openid.net/pipermail/openid-general/2009-April/017840.html .

This is in effect following Google's practice of logging out one's entire identity simultaneously.

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested in mailing list, 'openid-general' by an Andrew Arnott here: http://lists.openid.net/pipermail/openid-general/2009-April/017856.html and by someone else here : http://lists.openid.net/pipermail/openid-general/2009-April/017840.html .

This would be, in effect, merely following Google's practice of logging one out of the entire identity simultaneously, which presumably we are all familiar with.

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested by an Andrew Arnott here in mailing list, 'openid-general': http://lists.openid.net/pipermail/openid-general/2009-April/017856.html

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

Something like this is described here in mailing list, 'openid-general': http://lists.openid.net/pipermail/openid-general/2009-April/017840.html

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested in mailing list, 'openid-general' by an Andrew Arnott here: http://lists.openid.net/pipermail/openid-general/2009-April/017856.html and by someone else here : http://lists.openid.net/pipermail/openid-general/2009-April/017840.html .

This is in effect following Google's practice of logging out one's entire identity simultaneously.

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider is also desired.

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OpenID Provider (OP, openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

Something like this is described here in mailing list, 'openid-general': http://lists.openid.net/pipermail/openid-general/2009-April/017840.html

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested by an Andrew Arnott here in mailing list, 'openid-general': http://lists.openid.net/pipermail/openid-general/2009-April/017856.html

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

Something like this is described here in mailing list, 'openid-general': http://lists.openid.net/pipermail/openid-general/2009-April/017840.html

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.