4 ms·
The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're acti
by dkdbejwi383 5y ago
The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day.
We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.
- Cthulhu_ 5y agoAfter 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.
- Retric 5y agoCareful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.
- hallway_monitor 5y agoPTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.
- ta988 5y agosounds like what an extension could do. store in localstorage the last hour of forms. I especially hate clicking submit to get an error and an empty form again.
- alistairSH 5y agoUgh, a form that takes 15 minutes or more to fill out, without any feedback or other interaction, is itself a UX problem. It should at least be auto-saving.
- egypturnash 5y agoMore likely it will have a “submit” button that runs a script that blocks submission wen you missed a field. And wipes out a couple of other fields (usually passwords) so that you have to re-enter those after hitting that “submit” button again.
- cactus2093 5y agoBut should all sites really be optimized for the user at a public library computer? At the expense of convenience for the large majority of users that are on a personal or work computer? Doesn’t make much sense to me. Also the computer itself solves this problem for you in many cases, a guest profile typically deletes all browser session info when you log out.
- alistairSH 5y agoAll sites? Probably not. Many sites? Probably. You're assuming people log out reliably or otherwise behave in the most secure way. They don't. I also don't see how logging out/killing a session after 15 minutes of inactivity is much of a hardship for the user.
- fauigerzigerk 5y agoI hate _all_ sites that do this and I actively avoid them. There are many very good reasons why I might not be able to complete a form without interruption. It's not for them second guess me. And it's not just extremely annoying, it's also completely unnecessary. Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly.
- alistairSH 5y agoJust put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly. That works. It defaults to the "safe" behavior, but allows users to self-select into other behavior that they find less objectionable. FWIW, my end-users are using public computer labs, so we have to build for the worst-case in terms of user security habits.
- cm2187 5y agoThe ones that puzzle me even more are the intranet websites that log you off after x minutes whereas they work with single sign on, ie no password entered, so not sure what security benefit that achieves. But they make you lose whatever you were doing in the process.
- chillfox 5y agoUsually that comes down to single sign off being a lot harder to do than single sign on. So they just use a timer on each app for the sign off.
- kenniskrag 5y agoimho better would be if the site just asks for the 2fa again after sending the form.
- sneak 5y agoThe problem with the security industry is that there's no way for non-experts to reliably assess "I'm an expert, trust me!" from a practitioner. I'm not really sure what the best fix is; there are many possible ones. I've seen total clowns pushing decades-old nonsense be taken seriously by competent businesses simply because they thought "hiring an expert" was enough, like they're a plumber or something.
- _jal 5y agoIt is no different than doctors or mechanics or lawyers. Reputation is your best guide. In security-land, there are some certifications that are fairly rigorous; some of those can serve as a distant second.
- dvtrn 5y agoDoctors and lawyers are professions that are regulated by licensure, of which unauthorized practice comes with actual real and not made up legal consequences. Where is the similar licensure that tech security professionals are regulated by? I think that’s a big difference.
- abcxjeb284 5y agoThis one is based in security standards :( https://security.stackexchange.com/questions/45455/which-security-standards-define-the-time-of-inactivity-before-locking-the-screen https://security.stackexchange.com/questions/45455/which-sec... (link talks about screen locking but similar vibe for app logout for various certification bodies)
- dkdbejwi383 5y agoAt least this is based on "inactivity", compared to "authentication tokens must have a maximum lifespan of 15 minutes"
- Jach 5y agoWhat continues to grimly amuse me is that many of these websites that also have a mobile app will basically keep you signed in forever on the mobile app. It's just the website, where most people would prefer to do their heavy lifting work on, that has the anti-usability nonsense that makes you install plugins like auto-refresh-every-10-minutes.