Same problem still present - no password entry required to log in
I basically had the same problem today.
I am a new user, but my email was verified and the account registration completed.
I'm not [yet] using StackOverflow that way and I did not verify that part of the problem.
Apparently it does not make a difference from where I log out...
meta.stackexchange.com requires me to provide the password to log in
-> expected and appreciated behaviour. ,/
http://stackexchange.com/ however only requires me to select the openid provider to "log in"
-> a few mouseclicks
->no password required X
This raises the question, why there are links to log out at all.
They do not provide the additional security, their presence suggests!
Anyone who can get his hands on that browser [profile] could just [mis]use my account.
- unless I can and do clear the corresponding cookies.
(I removed all stackexchange cookies, after that I was required to provide a password to log in.)
[One of] the logout links should also remove the corresponding cookie[s]!
I have however found none that does.
I have carried that problem as far as I could at the moment.
Hopefully that will somehow bring us closer to a useful solution.
An idea for a workaround
I do have an idea, how this problem could be worked around - until a real solution is known and available.
(There may be obstacles, I do not yet know about and I do not know if or when I would get to implementing it.)
- Find out what cookie[s] are relevant for that auto log in.
- Create a bookmarklet to use for logout - at least to remove those relevant cookies.
I guess that would require the user to be able to add that bookmarklet to the browsers bookmarks, else I don't know how that could help (a user sharing a browser with others...).
I'm also one who would appreciate better solutions or even code implementing my limited suggestion.
Progress for workaround
(Editing as/if more news are available...)
I believe, I identified the relevant cookie:
cookie name: usr
Ok, it seems I have found a real solution now:
This apparently logs you out of that openid provider account properly.
In that process the above cookie will be removed.
Your logout will also be logged among your other related activities that way.
Perhaps stackexchange could provide that link at it's logout page.(?)
(If there is, I have not found it so far.)
Even then a complete logout will require (at least) 4 clicks...