Can we have an actually working tool to invalidate all sessions stored on all machines?

One stolen cookie means your account is permanently compromised despite a password change and use of the global logout tool (chat too).

  • Wow that is scary. Its so easy to grab a session cookie on an open network. Dec 4 '13 at 21:38
  • 1
    Almost as scary as an attacking hobo... Dec 4 '13 at 21:54
  • 1
    It would be kinda nice since we don't have SSL everywhere. Hey, does anyone else smell burning wool? :)
    – voretaq7
    Dec 4 '13 at 22:01
  • 3
    Are you talking about a compromised session key for one of the sites on this network, or a compromised auth cookie from your openID provider? The former should be handled through loging out, the latter is an issue to take up with your openID provider. SE has no control over that. (Unless you're referring specifically to SE's openID provider.)
    – Servy
    Dec 4 '13 at 22:06
  • Given the situation, this was most likely a shared computer. Dec 5 '13 at 15:07
  • 1
    I think there certainly should be a destroy all my SE sessions at all computers button somewhere. Maybe we shall ask the experts for opinion ;)
    – yo'
    Dec 5 '13 at 18:08
  • Definitely an SE OpenID flaw, it was the only provider ever attached to my account at the time of the issue. The Problem is that SE OpenID does not provide a global logout option, making each sites global logout a silly useless tool when combined with SE OpenID.
    – MickLH
    Dec 12 '13 at 6:33

You must log in to answer this question.

Browse other questions tagged .