1

I found myself in the following situation. I forgot my password to my account. After resetting my key I logged into Stack Exchange. By mistake I forgot to save it in my password manager. Since I still had the password copied, I thought the easiest way to get the password in my password manager was to log out and then log in again. After which I can press the yes button to the "save this password" question.

After I logged out I tried to log in page. It said something about third party cookies not enabled so I couldn't log-in. I pressed the button that says "you can still log in manually". Pressing this button logged me in. I never provided my password during this process. I'm 100% sure the password was not provided by my password manager and it was a random generated password.

For a public computer this means logging out does not actually prevent a subsequent user of the computer to log you in again. This seems a security vulnerability since a user can expect you'll need your password to log-in again after logging out.

Maybe someone can tell me if this is a bug or a feature.

Browse other questions tagged .