12

I always log in to Stack Overflow using my Google OpenID.

I went to an Internet cafe and just used Stack Overflow, and when I was finished, I logged out. When I came back to my seat, I found another guy using my Gmail account.

My question is: how can he access my Gmail account even after I logged out of Stack Overflow? I would like to know the technical concept behind this.

I would additionally request that the wording of the log-out message be changed to clearly mention that logging out from Stack Overflow will not log you out from Google. Also, add a hyperlink that explains single sign on.

You can login with any Google, Facebook, Yahoo or StackExchange account that uses any of the emails above.

Clicking Log Out will clear all local credentials in your browser, and log you out on all devices.

I first asked this question on Stack Overflow and I was suggested to post it here.

Improve this question
5
  • 3
    Why in the world would you think that message applied to anything other than Stack Exchange sites? Yes, logging out will clear all local credentials in your browser, and log you out on all devices from Stack Exchange sites. – Cody Gray Mar 16 '12 at 9:01
  • 6
    @Cody someone new to OpenID, especially on a non-programming SE site, who signed up with an OpenID provider just to log in here might indeed not realize it. – Pekka Mar 16 '12 at 9:03
  • 4
    @CodyGray Pekka is correct. Stack Exchange is a first experience with OpenID for many people (and a constant source of account related problems that new users experience). – Tim Post Mar 16 '12 at 9:22
  • 1
    I didn't realise this at all -- yikes! – Chris Burt-Brown Mar 16 '12 at 12:06
  • 1
    See also Improve SE OpenID logout security and user experience on shared or public machines, though that mainly covers the implications of the logout mechanism for SE OpenIDs, not Google's. – Charles Mar 16 '12 at 20:33
4

You login out from stackoverflow, but you also need to log out from google.

This two logins are different. The SO is just take from google the OK that your can login to this account, but when you log out from SO this is not log you out from google. This two logins are not work together are separate.

To say some more details.

When you login to google, google set you a cookie and connect you with his database to know your status.

When you login to SO from google, google gives the OK to StackOverflow and SO set a second cookie that know that you login to SO.

The one company can not take or change the others company cookie and login status.

So to log out from both of them, you need to make separate logouts.

One more, google gives you a check box that say "Stay signed in". Do not check that when you are on public computers. When you do not check it then the login session is terminate when you close the browser.

About the request.

Apparently there are many people that did not know, or not imaging all that technical data, some of them they are new to internet, new to computers, etc, so maybe there need for a very clear message that the logout is not done on all sites that use open id, and maybe some more note what and how open id let you login. Maybe some one with better English than me can write a message for that.

Improve this answer
2
  • This is all well and good, but what is your answer to the feature request? It's obvious from this 14-line explanation that the issue is complex, and not everybody can be expected to understand it. Hence, a better wording should be chosen to make it clearer. – Pekka Mar 16 '12 at 10:39
  • @Pekka Yes you have right I miss that... – Aristos Mar 16 '12 at 11:19
3

I agree.

This behaviour is not intuitive, especially if you signed up with an OpenID provider for the sole purpose of logging in to a SE site.

It could read like this:

You can login with any Google, Facebook, Yahoo or StackExchange account that uses any of the emails above.

Clicking Log Out will clear all local credentials in your browser, and log you out on all devices.

Note: logging out from the Stack Exchange network does not log you out with your identity provider. You can read more on how OpenID works here. (link pointing to a good informational resource)

Improve this answer
3
  • 3
    Come on, you can do better than that. Give me some reason not to turn this into a comment... =) – casperOne Mar 16 '12 at 13:52
  • You really scolded someone else for their incomplete answer and then posted this? – Michael Mrozek Mar 16 '12 at 13:59
  • @Michael well, this does address the question, even though just in the affirmative. Aristos' answer was a great explanation of what goes on behind the scenes, but it didn't address the feature request. It does now. (Let me work up a wording suggestion though to make this a bit more... substantial.) – Pekka Mar 16 '12 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .