Can we have an actually working tool to invalidate all sessions stored on all machines?

One stolen cookie means your account is permanently compromised despite a password change and use of the global logout tool (chat too).

  • Wow that is scary. Its so easy to grab a session cookie on an open network. Commented Dec 4, 2013 at 21:38
  • 1
    Almost as scary as an attacking hobo... Commented Dec 4, 2013 at 21:54
  • 1
    It would be kinda nice since we don't have SSL everywhere. Hey, does anyone else smell burning wool? :)
    – voretaq7
    Commented Dec 4, 2013 at 22:01
  • 3
    Are you talking about a compromised session key for one of the sites on this network, or a compromised auth cookie from your openID provider? The former should be handled through loging out, the latter is an issue to take up with your openID provider. SE has no control over that. (Unless you're referring specifically to SE's openID provider.)
    – Servy
    Commented Dec 4, 2013 at 22:06
  • Given the situation, this was most likely a shared computer.
    – House
    Commented Dec 5, 2013 at 15:07
  • 1
    I think there certainly should be a destroy all my SE sessions at all computers button somewhere. Maybe we shall ask the experts for opinion ;)
    – yo'
    Commented Dec 5, 2013 at 18:08
  • Definitely an SE OpenID flaw, it was the only provider ever attached to my account at the time of the issue. The Problem is that SE OpenID does not provide a global logout option, making each sites global logout a silly useless tool when combined with SE OpenID.
    – MickLH
    Commented Dec 12, 2013 at 6:33


You must log in to answer this question.

Browse other questions tagged .