26

This is absolutely unacceptable.

I logged in to my StackOverflow on a shared work computer. After logging out, no matter what I do, I am automatically logged back in whenever someone visits 'log in'->'Log in with Stack Exchange'

THERE IS NO OPTION TO ENTER LOGIN CREDENTIALS. Just '...' then I'm logged in.

I've looked through all the preferences and found no way to permanently log out. I've cleared cookies and rebooted the browser but the only solution is to restart the computer and wait a few minutes.

I'm all for usability over configuration, but is this for real?

Just thinking of all the computers I've logged in to SO on that could be divulging my private information is unnerving. This could be a massive security problem!

Why on earth would there be an unconditional autologin feature?

Someone bring me to clarity before I melt.

Improve this question
13
  • Start a private browser session when using Stack Overflow. Then it won't remember your login.
    – juergen d
    May 6, 2013 at 18:22
  • 17
    If I have to privately browse this site to avoid being permanently logged in, that's absurd.
    – Silvius
    May 6, 2013 at 18:23
  • 1
    @Silvius: Clear your cookies and log out of whatever openid provider.
    – Engineer2021
    May 6, 2013 at 18:26
  • 2
    Is keeping users from logging in again after signing out really a useful tradeoff versus compromising the security of anyone who is unaware of this strange policy?
    – Silvius
    May 6, 2013 at 18:30
  • 2
    @Silvius Logging out should see you logged out everywhere. If I'm not mistaken even on other devices. If you actually log out and that doesn't happen, there might be something wrong.
    – Bart
    May 6, 2013 at 18:45
  • 1
    I can't tell if this is a feature or a bug. Logging out says "This will clear our cookies and log you out on all devices." Obviously, the cookies go nowhere, and I will just be automatically logged in as soon as someone else decides to visit the login page.
    – user
    May 6, 2013 at 18:47
  • 1
    @Bart- Even if I am logged out everywhere, all someone has to do is click 'Log in with Stack Overflow' and my information is theirs.
    – user
    May 6, 2013 at 18:48
  • 2
    @Silvius Just now realized this. Pretty absurd indeed.
    – user
    May 6, 2013 at 19:57
  • 3
    @0A0D cookies aren't enough, local storage is also used.
    – Shadow Wizard Is Sad And Angry
    May 6, 2013 at 20:49
  • 1
    Here's a screencast of this insanity. What is even the point of that "log out" link?!
    – RomanSt
    Feb 1, 2014 at 21:57
  • 2
    @romkyns You're probably logged into Facebook. Log out of that. Then it should work.
    – hichris123
    Feb 1, 2014 at 22:20
  • 1
    I've done it too - BIG PROBLEM!
    – Jamie
    Feb 2, 2014 at 13:18
  • Related: Tell me how to log out of Stack Exchange OpenID
    – This_is_NOT_a_forum
    Jan 3, 2018 at 14:32

1 Answer 1

Reset to default
5
+50

To log in via any open id provider (for example facebook, or google) on stackexchange, you have to log into your account at said openid provider first.

So what's the point?

By logging out of StackExchange, you are logged out of stackexchange, but not automatically logged out of your openid provider (and this should never be the case). If you log into StackExchange via google, and log into youtube as well, logging out of stackexchange should not automatically log you out of your email (gmail) or youtube (google+ link) as well.

So how do I really logout then?

The logout button correctly logs you out of stackexchange. From that point on you browse as a guest, until you decide to login again. To prevent yourself from automatically logging in, you have to log out of your openid provider as well. If you don't do that, people on that computer can access your facebook profile or gmail too, as well as any other service you logged into during that session with your open id provider.

TL;DR Log out of every site you logged into, including gmail/facebook etc.

But do I really have to remember every site I quickly logged into?

No, no you don't.

If you are on a shared computer where you can't be sure of your account security, don't enter your credentials ever. Use a dummy account or browse as a guest.

If you are on a shared computer where you trust your credentials won't be stolen, use the privacy mode of your favorite browser: incognito mode for chrome/firefox, inPrivate in Internet Explorer, probably a similar name in other browsers. This mode allows you to browse freely on the internet, but the browsing history is not saved and, more importantly, when you close this browser window, all cookies from that session are deleted too. Since that cookie is required to stay logged in, you'll log out from every site, and anyone else that uses the computer will not be able to log in as you. This is also great if you quickly want to check your email at a friend's place, because private browsing is a complete new session (meaning you can log into your email, even if your friend uses the same email provider). Of course, this method will not protect you against malware on such a computer or a network.

TL;DR Use private browsing modus of your browser AND close the browser completely before leaving the computer.

Improve this answer
1
  • Why is that something we are forced to commit to though? We can't the default behavior just be that when we close the browser, we're automatically signed out? I didn't register with my Google or Yahoo and simply have a StackExchange account. I'm sure it's doing the same thing underneath, but this is just more trouble than it's worth. Why can't there be an option for this in our settings? Surely it can't be that hard to implement. At least make it available for those of us who don't have our account linked to a 3rd party site (e.g. Google).
    – ThatRandomGuy
    Feb 3, 2017 at 1:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .