1

I found myself in the following situation. I forgot my password to my account. After resetting my key I logged into Stack Exchange. By mistake I forgot to save it in my password manager. Since I still had the password copied, I thought the easiest way to get the password in my password manager was to log out and then log in again. After which I can press the yes button to the "save this password" question.

After I logged out I tried to log in page. It said something about third party cookies not enabled so I couldn't log-in. I pressed the button that says "you can still log in manually". Pressing this button logged me in. I never provided my password during this process. I'm 100% sure the password was not provided by my password manager and it was a random generated password.

For a public computer this means logging out does not actually prevent a subsequent user of the computer to log you in again. This seems a security vulnerability since a user can expect you'll need your password to log-in again after logging out.

Maybe someone can tell me if this is a bug or a feature.

3
  • You do understand there is no such thing as true randomness other than RFC 1149.5? – Cole Johnson Oct 15 '13 at 13:12
  • 1
    It's officially considered a feature, but should be considered a travesty of a security bug. Complete insane user-hostile behaviour. – Jeremy Oct 15 '13 at 16:01
  • Also see meta.stackexchange.com/questions/202518/… – user233836 Oct 22 '13 at 7:57

Browse other questions tagged .