24

The cookies for subdomain, 'openid.stackexchange.com' are not, as claimed, actually removed from the browser upon logging out of stackexchange.com, but they should be.

Applies to: * stackexchange.com, date: January 8, 2012

Desired result:

  • Upon logging out of Stack Exchange, Stack Exchange OpenID local credentials stored 'in your browser' (or stored anywhere on the user's computer) should actually be deleted, as promised. For example, Stack Exchange OpenID browser cookies actually should be deleted.
  • Logging in again should require explicitly entering one's credentials again. This might be email address and password.
  • It is misleading to claim that (all relevant) 'local credentials in your browser' are deleted, since anyone else sitting down at the same computer can merely click the login links and immediately be accepted as the same, previous user! (See procedure to duplicate, below.)

Procedure to duplicate the problem in FireFox:

Versions (Menu-Help-Troubleshooting Information-Application Basics-User Agent): * Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1

  • Start FireFox.
  • In Firefox's cookies manager (Menu-Tools-Options-Privacy), click the button, 'Exceptions', enter stackexchange.com and stackoverflow.com, and each time, click the button, 'Allow for Session'.
  • Click the button, 'Close'.
  • Click the button, 'Show Cookies'. Type, 'Stack', select stackexchange.com and stackoverflow.com if they are there, and each time, click the button, 'Remove Cookies'.

  • Close Firefox.

  • Start Firefox.

  • Close webmail notifier windows.
  • Log out of Gmail.
  • Wait ten seconds.

  • Click the back button on the browser to make sure one is not still logged in to Gmail.

  • Open a tab for, https://stackexchange.com/ .

  • In NoScript, if you have it, allow the domains, 'stackexchange.com' and, 'sstatic.net' and refresh.
  • Click the link at the top, 'login'.
  • On the resulting page, click the box, 'Log in with Stack Exchange.'
  • Enter one's Gmail email address and Stack Exchange password, which results in a successful Stack Exchange login.
  • Click the link at the top, 'logout'.
  • The resulting web page has an orange button labeled, 'logout', above which is presented the text, 'Clicking Log Out will clear all local credentials in your browser.'
  • Click the orange button labeled, 'logout'.

One might think that one has completely logged out safely from Stack Exchange, with no possibility of simply clicking back in. But, not true!

  • Now the page has the link at the top, 'login'.
  • However, the Firefox Cookie Manager still shows cookies under domains, 'stackexchange.com' and 'openid.stackexchange.com'.
  • Click the link at the top, 'login'.
  • On the resulting page, again click the box, 'Log in with Stack Exchange.'
  • See the login unexpectedly succeed, without entering any email address or Stack Exchange password!
Improve this question
32
  • SeaMonkey isn't supported Which browsers are officially supported? And what else do I need?
    – Sathyajith Bhat
    Commented Jan 7, 2012 at 17:42
  • 1
    As an aside: how is "clear all local credentials" the same as "remove all cookies"? (It should indeed clear the relevant contents of any cookies though, if applicable.) Also, for further testing, beware of the stackauth.com domain and its usage of HTML5 Local Storage too. (I've not verified the behavior you're describing above.)
    – Arjan
    Commented Jan 7, 2012 at 17:44
  • 1
    Do you think the bug is for Stack Exchange as an OpenID provider, or the Stack Exchange family of sites as OpenID consumers? (I don't seem to run into this using my own OpenID provider, and of course I am not expecting Stack Exchange sites to clear any cookies from my OpenID provider. But I've no SE OpenID account to test with.)
    – Arjan
    Commented Jan 7, 2012 at 19:32
  • 6
    This happens with the google, and almost every other OpenID provider as well, what's the issue here? You logged out of our sites, not the OpenID provider. For example, you can do this logging in with a google account anywhere as well, only logging out of google will require credentials again...you didn't log out of openid.stackexchange.com which is it's own distinct provider (which you can use on other sites, not just ours), only the Q&A sites. IMO, the logout button on our sites shouldn't introduce odd re-enter-credentials behavior on other sites you used our provider with.
    – Nick Craver Mod
    Commented Jan 8, 2012 at 22:43
  • 7
    @NickCraver SSO is pretty unintuitive, and particularly so when the provider and consumer are on the same TLD. Considering that SE is now trying to appeal to relatively non-tech-savvy users, it should be considered a security problem that so many users will not understand how logging out of their account works.
    – Jeremy
    Commented Jan 8, 2012 at 22:51
  • With FireFox also, the bad thing happened (as edited above). The StackExchange webpage's claim to log users out is misleading (see above). Both altering cookie contents or deleting entire cookies would work, but deleting entire cookies is better, because more apparent. Removing the cookies for just the domain, 'openid.stackexchange.com' was enough to cause the credentials to be re-requested and prevented the insecure re-login. This is StackExchange's problem as an OpenID provider. Websites outside the StackExchange family trusting the StackExchange OpenID provider would be insecurely accessed.
    – MarkDBlackwell
    Commented Jan 8, 2012 at 23:06
  • @NickCraver, What made you think I logged out of 'your' sites? I did not log out of any Q&A site. I went through the log out procedure on the webpage with URL, 'stackexchange.com', thus I think I did, as you recommend, log out of the StackExchange OpenID provider (but unsuccessfully). I never clicked any link for another Stack family webpage (during the test procedure). (It is irrelevant that I am posting on StackOverflow.)
    – MarkDBlackwell
    Commented Jan 8, 2012 at 23:14
  • @NickCraver, the logging out URL was stackexchange.com/users/logout?returnurl=%2f .
    – MarkDBlackwell
    Commented Jan 8, 2012 at 23:20
  • 1
    @JeremyBanks, not merely users not understanding, but it seems logging out (of StackExchange OpenID provider) is not actually working or functional!
    – MarkDBlackwell
    Commented Jan 8, 2012 at 23:23
  • 1
    @MarkDBlackwell Yes, this is the correct place. There used to be a distinct meta.StackExchange but it was merged into meta.StackOverflow.
    – Jeremy
    Commented Jan 8, 2012 at 23:47
  • 6
    As Nick mentioned, logging out from http://stackexchange.com/ is something very different than logging out from the OpenID provider at http://openid.stackexchange.com/. You need to log out of your Stack Exchange OpenID, otherwise yes, the OpenID provider can still authenticate you.
    – Tim Stone
    Commented Jan 8, 2012 at 23:59
  • 2
    @Tim is correct, I think the confusion here is the simply shared TLD, think of it as openid.stackexchangeopenidprovider.com instead, would you assume you've logged out there when logging out of stackexchange.com?
    – Nick Craver Mod
    Commented Jan 9, 2012 at 1:23
  • 2
    @NickCraver The OpenID provider should know if the account is used for sites other than SE, so you could make a distinction there. If it is only used for SE sites, have the logout button log you out of the SE OpenID provider completely. And display a notice on logging out if you don't log out of OpenID, to remind users of that.
    – Mad Scientist
    Commented Jan 9, 2012 at 9:44
  • 2
    I think it's probably worth asking a new question which cuts out all the technical discussions and goes directly to the user confusion issue, best highlighted by @Jeremy Bank's answer (IMO)
    – Benjol
    Commented Jan 11, 2012 at 10:01
  • 2
    As I answered for your last question, I believe the merit here is orthogonal to the protocol used. It's simply that logging out of stackexchange.com does not log you out of another site under the same TLD. If you whittle it down to just the little issue, you might get more traction here.
    – Andrew Arnott
    Commented Jan 15, 2012 at 16:06

5 Answers 5

Reset to default
22

Single sign on is a great goal.

Single sign out should have accompanied it.

It didn't.

OpenID does not provide a mechanism nor a standard process for single sign out.

If I sign into Stack Exchange, then logout of my OpenID provider, the next user can still use my Stack Exchange account.

If I instead log out of Stack Exchange without signing out of my OpenID provider, the next person can log back into my Stack Exchange account without signing into my OpenID provider again.

I have to sign out of both Stack Exchange and my OpenID provider to ensure that I'm signed out completely.

This is counter-intuitive, and education is the only thing that might help resolve the issue.

Solution

I suggest that when a user logs out of Stack Exchange the next page shown suggests they also log out of their OpenID provider to make sure the next user cannot easily log back into their account on this computer. It should link to their OpenID provider's logout page (if any) to make this process simple and intuitive.

Improve this answer
4
  • 2
    For those curious about single sign out solutions, check out google.com/search?q=single+sign+out+openid - you'll find that many discussions have taken place about this on stackoverflow itself, as others try to find a good solution to this complex issue.
    – Pollyanna
    Commented Jan 9, 2012 at 21:57
  • The first part of your solution seems feasible to me. Nice. But: as OpenID does not specify a standard logout procedure (right?), how would OpenID consumers know what the URL of a logout page for a specific OpenID provider would be? (Surely SE does not know what the logout page of my self-hosted OpenID provider is, as I have no such page.)
    – Arjan
    Commented Jan 9, 2012 at 23:21
  • 1
    @Arjan, By OpenID consumers, do you mean the Relying Parties (RP)? RP would not need to know the OpenID Provider's logout page. After logging out of an RP, the OP's root URL (homepage) would be a good fallback to redirect browsers to, because it probably shows the login status; anyway, it would remind the naive user.
    – MarkDBlackwell
    Commented Jan 9, 2012 at 23:44
  • Good suggestion, I just made it here as well.
    – user154510
    Commented Jan 17, 2012 at 23:54
16

Arjan points out that logging in requires you to explicitly select an OpenID provider1. This is true, but this is not made obvious to the user. Consider a user who is not particularly tech-savvy nor familiar with the concept of single sign-on (except for that one time they used Twitter to login to yfrog). This may or may not represent a typical current user, but it represents many of the users Stack Exchange wants to have so it's a valuable perspective to consider.

Say that such a user decides to login to a Stack Exchange site. They're presented with the set of choices below and pick the option they're most familiar with from other sites: the big link "click here to sign up".

This link doesn't do anything unusual like send them to a separate domain or section of the site, it just loads the registration form into the page. After they've signed up, the email confirmation link even redirects you back to the original site. It's a very seamless process, much like signing up on any other site.

Should we expect this user to have noticed that they've done something different than when they've registered on other websites? The login sidebar mentions OpenID, but most users who actually read it will probably think it's just referring to the MyOpenID link, unless they they were previously aware of OpenID. OpenID is not referenced anywhere else. Granted, the registration sidebar says the account can be used for any Stack Exchange site, but taken together this is not enough to expect the user to understand that the login system is separate from the site, nor that logging out securely is a two-step process.

Users who don't understand the system they're using are much more likely to put themselves at risk, most easily by forgetting or not knowing the second step to log out. I know Stack Exchange accounts aren't the most valuable thing in the world2, but for what they're worth this should be considered a significant security issue.

1 Some are actually OAuth, but the the page doesn't mention that.
2 ...though the Stack Exchange OpenID password requirements may make you think otherwise.

Improve this answer
3
  • The Stack Exchange OpenID account is even more valuable than just for the Stack Exchange Network since, as suggested on the page you screen-captured, I presume anyone can use it to create accounts on any of thousands of websites, then perhaps neglect to log off from a shared (public, or at a party) computer.
    – MarkDBlackwell
    Commented Jan 11, 2012 at 9:18
  • Not only is the 'require[ment] to explicitly select an OpenID provider...not made obvious to the user', it is hidden by design.
    – MarkDBlackwell
    Commented Jan 14, 2012 at 5:11
  • This seems to have been resolved by changes to the login/signup flow.
    – Jeremy
    Commented Mar 21, 2015 at 18:11
10

For some time I figured that your last bullet,

  • See the login unexpectedly succeed, without entering any email address or Stack Exchange password!

...implied that you did not do anything to initiate the login.

But, as your penultimate bullet states: you actually clicked one of the OpenID buttons, which makes Stack Overflow (or any other SE site, in its role as OpenID consumer) delegate the login to that very provider. For that very provider, you're still logged in, so it tells the consumer who you are, without asking you for any credentials.

This behavior is totally the same as that of my non-SE OpenID provider (though I need to enter a URL manually because my provider is not one of the quick access buttons).

Known OpenID providers

Improve this answer
4
  • 1
    The button does not distinguish StackExchange from the StackExchange OpenID provider; this unexpectedness is something the naive user experiences after registering with StackExchange. The problem is peculiar to the OpenID.StackExchange provider, since users know how to log off the others.
    – MarkDBlackwell
    Commented Jan 9, 2012 at 20:40
  • 2
    Of course, I clicked the Stack Exchange OpenID button. I never said I didn't; you said I implied this but I did not. I said I did not enter any email address or Stack Exchange password. Hiding from a naive, new Stack Exchange user, they resided in a cookie managed by the Stack Exchange Network. I am well aware that currently one of the implementations of logging in to Stack Exchange is through openid.stackexchange.com; but merely a few clicks was sufficient to complete the login, which on a shared computer an attacker can do also; therein lies one of the problems.
    – MarkDBlackwell
    Commented Jan 11, 2012 at 8:12
  • The other problem is a potential danger to Stack Exchange regarding its public image.
    – MarkDBlackwell
    Commented Jan 11, 2012 at 8:13
  • I just tried this out on stackexhange.com, and I didn't need to push any of the buttons to get me logged back in automatically: meta.stackexchange.com/questions/211583/…
    – SztupY
    Commented Dec 14, 2013 at 18:30
7

The Stack Exchange Network (Relying Party, RP), before any kind of logout, should ask whether logging out from the current OpenID Provider (OP) is also desired, as suggested in mailing list, 'openid-general' by an Andrew Arnott here: http://lists.openid.net/pipermail/openid-general/2009-April/017856.html and by someone else here : http://lists.openid.net/pipermail/openid-general/2009-April/017840.html .

This would be, in effect, merely following Google's practice of logging one out of the entire identity simultaneously, which presumably we are all familiar with.

If the answer is no, the RP logout can proceed.

If the answer is yes, first provide a link to some page (the home page is a fallback) of the current OP (openid.stackexchange.com in this case), unless unnecessary (like Google, FaceBook and maybe Yahoo). The RP logout should be refused until the OP service replies as logged out, then the RP logout can proceed.

The problem is, naive users know when they have signed into Google. They don't know when they have signed into openid.stackexchange.com, because they aren't told about it. (Please focus on users, now.)

After researching, I know more of what's happening (technically). Many newly registered users don't. These are the ones naive to OpenID and not selecting Facebook, Google or Yahoo but instead selecting, 'log in with Stack Exchange'. They have a security problem, unless the Stack Exchange Network does as described above.

Improve this answer
3
  • 6
    While a mailing list opinion is great, I'd expect anything labeled "Correct" to have a reference to the official documentation. Otherwise it appears to be a suggestion made by one person whom we know little about.
    – Pollyanna
    Commented Jan 9, 2012 at 21:42
  • I would happily rephrase my answer to, 'The StackExchange family of websites should...' if that would be better! :)
    – MarkDBlackwell
    Commented Jan 9, 2012 at 22:35
  • Of one of the openid-general mailing list posters (rabbit) I know little, but privately @AndrewArnott has confirmed to me he is the Andrew Arnott who made the other post.
    – MarkDBlackwell
    Commented Jan 14, 2012 at 5:17
-4

This is not really insecure (depends on user education) since clearing all browser private data (i.e cookies, cache, active connection, etc...) resolves the automatic login redirection and force to input credential for next login/authentication. Of course it's not convenient

EDIT : As @Martin said

LocalStorage isn't cleared when deleting browser's private data

So here I provide some more precision :
I don't really know/care if LocalStorage is cleared at all. What I want is to be forced to input my credentials when I try to Login after I clicked on Logout (using my stackexchange openID creds). I've even seen clients using OAuth which behave like that

My using of the term "delete browser private data" may be inappropriate to define what I really did. But after doing what I said then stackexchange asked me to input my credentials (and that wasn't the same when I just deleted cookies).

So what I did in Firefox corresponds to what is described in this link (as I haven't enough reputation to upload screenshot) : Support.Mozilla : Clear Recent History (With all checkbox checked in "Details")

Improve this answer
2
  • This is a lie. LocalStorage isn't cleared when deleting browser's private data.
    – Martin.
    Commented Mar 12, 2012 at 17:00
  • @Martin I don't know/care if LocalStorage is cleared or not. But when I do CTRL+SHIFT+DELETE with Firefox (and asume all checkbox are checked) then stackexchange ask me to input my credentials when I click on "Login" again. I can post a screenshot if you want :p
    – user1199680
    Commented Mar 12, 2012 at 18:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .