Can we have a working global logout?

Ask Question

Asked 11 years ago

Modified 11 years ago

Viewed 136 times

Can we have an actually working tool to invalidate all sessions stored on all machines?

One stolen cookie means your account is permanently compromised despite a password change and use of the global logout tool (chat too).

6,6594 gold badges37 silver badges55 bronze badges

asked Dec 4, 2013 at 21:26

MickLH

3071 silver badge6 bronze badges

Wow that is scary. Its so easy to grab a session cookie on an open network.
– AttackingHobo
Commented Dec 4, 2013 at 21:38
1

Almost as scary as an attacking hobo...
– ThisSuitIsBlackNot
Commented Dec 4, 2013 at 21:54
1

It would be kinda nice since we don't have SSL everywhere. Hey, does anyone else smell burning wool? :)
– voretaq7
Commented Dec 4, 2013 at 22:01
3

Are you talking about a compromised session key for one of the sites on this network, or a compromised auth cookie from your openID provider? The former should be handled through loging out, the latter is an issue to take up with your openID provider. SE has no control over that. (Unless you're referring specifically to SE's openID provider.)
– Servy
Commented Dec 4, 2013 at 22:06
Given the situation, this was most likely a shared computer.
– House
Commented Dec 5, 2013 at 15:07
1

I think there certainly should be a destroy all my SE sessions at all computers button somewhere. Maybe we shall ask the experts for opinion ;)
– yo'
Commented Dec 5, 2013 at 18:08
Definitely an SE OpenID flaw, it was the only provider ever attached to my account at the time of the issue. The Problem is that SE OpenID does not provide a global logout option, making each sites global logout a silly useless tool when combined with SE OpenID.
– MickLH
Commented Dec 12, 2013 at 6:33

Add a comment |

0