2 ms·
All sites? Probably not. Many sites? Probably. You're assuming people log out reliably or otherwise behave in the most secure way. They don't. I also don't
by alistairSH 5y ago
All sites? Probably not.
Many sites? Probably.
You're assuming people log out reliably or otherwise behave in the most secure way. They don't.
I also don't see how logging out/killing a session after 15 minutes of inactivity is much of a hardship for the user.
- fauigerzigerk 5y agoI hate _all_ sites that do this and I actively avoid them. There are many very good reasons why I might not be able to complete a form without interruption. It's not for them second guess me. And it's not just extremely annoying, it's also completely unnecessary. Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly.
- alistairSH 5y agoJust put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly. That works. It defaults to the "safe" behavior, but allows users to self-select into other behavior that they find less objectionable. FWIW, my end-users are using public computer labs, so we have to build for the worst-case in terms of user security habits.