12

Can we have an actually working tool to invalidate all sessions stored on all machines?

One stolen cookie means your account is permanently compromised despite a password change and use of the global logout tool (chat too).

migrated from meta.gamedev.stackexchange.com Dec 4 '13 at 21:52

This question came from our discussion, support, and feature requests site for professional and independent game developers.

  • Wow that is scary. Its so easy to grab a session cookie on an open network. – AttackingHobo Dec 4 '13 at 21:38
  • 1
    Almost as scary as an attacking hobo... – ThisSuitIsBlackNot Dec 4 '13 at 21:54
  • 1
    It would be kinda nice since we don't have SSL everywhere. Hey, does anyone else smell burning wool? :) – voretaq7 Dec 4 '13 at 22:01
  • 3
    Are you talking about a compromised session key for one of the sites on this network, or a compromised auth cookie from your openID provider? The former should be handled through loging out, the latter is an issue to take up with your openID provider. SE has no control over that. (Unless you're referring specifically to SE's openID provider.) – Servy Dec 4 '13 at 22:06
  • Given the situation, this was most likely a shared computer. – MichaelHouse Dec 5 '13 at 15:07
  • 1
    I think there certainly should be a destroy all my SE sessions at all computers button somewhere. Maybe we shall ask the experts for opinion ;) – yo' Dec 5 '13 at 18:08
  • Definitely an SE OpenID flaw, it was the only provider ever attached to my account at the time of the issue. The Problem is that SE OpenID does not provide a global logout option, making each sites global logout a silly useless tool when combined with SE OpenID. – MickLH Dec 12 '13 at 6:33

You must log in to answer this question.

Browse other questions tagged .