Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For instance, Gmail has allowed remote logout since 2008. I think I have seen other sites that allow you to log out all other logged-in sessions.

What are the tradeoffs to consider in this session management strategy?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

The feature is really useful from a security perspective as it allows users to easily notice if someone else is accessing the account. This is a really useful feature in the sort of attacks where the attacker would want to silently observe the account to obtain information without actually doing anything active which would draw attention to himself.

The biggest downside I can think of would be an attacker being able to perform a denial-of-service attack against currently logged in accounts. Of course this isn't much of a downside as the attacker could do far worst if he is able to access your account.

share|improve this answer
add comment

It's mostly just a gain. From a security perspective, sessions should expire quickly, but from a usability perspective, users don't want to have to constantly log in. If you are going to allow persistent login, then offering a mechanism to clear persistent logins is a good (almost mandatory) idea. This way a user can clean up after themselves if they realize they might be logged in somewhere they don't want to be.

The only possible down side I can see is an attacker using it to block a legitimate user, but that can be overcome by simply keeping track if the current session has had a logon and only clearing sessions that are saved logons. (Think of the way that Amazon keeps your "login" but requires you to enter your password the first time you go to make a purchase.)

This way, you get the security of being able to ensure that old saved sessions are cleared but also prevent a user with the account credentials from being blocked out of the system. You still have a race condition to who can change the password first, but if you are worried about that, you can put additional security around the password change.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.