Can we have a working global logout?

Ask Question

Asked 9 years, 9 months ago

Modified 9 years, 9 months ago

Viewed 134 times

Can we have an actually working tool to invalidate all sessions stored on all machines?

One stolen cookie means your account is permanently compromised despite a password change and use of the global logout tool (chat too).

6,6844 gold badges35 silver badges55 bronze badges

asked Dec 4, 2013 at 21:26

MickLH

3171 silver badge6 bronze badges

Wow that is scary. Its so easy to grab a session cookie on an open network.
– AttackingHobo
Dec 4, 2013 at 21:38
1

Almost as scary as an attacking hobo...
– ThisSuitIsBlackNot
Dec 4, 2013 at 21:54
1

It would be kinda nice since we don't have SSL everywhere. Hey, does anyone else smell burning wool? :)
– voretaq7
Dec 4, 2013 at 22:01
3

Are you talking about a compromised session key for one of the sites on this network, or a compromised auth cookie from your openID provider? The former should be handled through loging out, the latter is an issue to take up with your openID provider. SE has no control over that. (Unless you're referring specifically to SE's openID provider.)
– Servy
Dec 4, 2013 at 22:06
Given the situation, this was most likely a shared computer.
– House
Dec 5, 2013 at 15:07
1

I think there certainly should be a destroy all my SE sessions at all computers button somewhere. Maybe we shall ask the experts for opinion ;)
– yo'
Dec 5, 2013 at 18:08
Definitely an SE OpenID flaw, it was the only provider ever attached to my account at the time of the issue. The Problem is that SE OpenID does not provide a global logout option, making each sites global logout a silly useless tool when combined with SE OpenID.
– MickLH
Dec 12, 2013 at 6:33

Add a comment |

0