Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that says I have successfully logged out. After I log out, clicking the button that is supposed to take me to the login page sometimes takes me right back into my account where I can view all my account information or modify and save details, or even delete the account. The log-off does work maybe 75% of the time but the other 25% it doesn’t, and that always seems to happen after I get an error about my SSO token when logging in. So I believe it’s related, I’m not sure how though.

Video uploaded here: https://www.youtube.com/watch?v=h7zZtHBWZsQ

I brought it up with their IT department. Their response was that they do not support individual computers and the different configurations that users may have, and it is most likely a problem with my computer or web browser configuration. Not that my configuration is that unusual (Up to date Chrome with no extensions on a Windows 7 desktop and laptop, and Firefox 22 on another Windows 7 desktop). The computer running Firefox is behind a corporate proxy and they said the proxy is probably causing the issues with logging out. Again I was told that they are not in the business of supporting users’ individual PCs so they can’t do much to fix how it behaves with proxies, and I should find a computer where the log-off works correctly.

Are my expectations for security privacy simply too high? A functional log out seems like a simple, basic expectation. If their website is so fragile that proxies or certain browsers have issues with fundamental things such as logging out, I am concerned that somebody who knows what they are doing could really do a lot of damage. Do I have legitimate concerns or is this nothing out of the ordinary?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You are absolutely right that the website should not behave like this. I'd say this particular issue is fairly low risk. But it makes me wonder: if they have this problem, what other problems do they have? More serious problems like SQL injection could allow an attacker to steal all the users' data.

The response from their support department is not satisfactory. However, I've found that to be a very widespread problem - even with some services I'm generally happy doing business with.

How much of a problem does this present you? I presume you are trusting the site with some personal data, but how much? How would a breach impact on you? With recruitment site, people often worry about their current employer finding out they are on the site. I would usually think it unlikely that your boss would mount a hacking attack on a site to see if any of the team are using it. It's far more likely to be an organised cyber crime gang hoping to use the data for financial gain.

There are some practical steps you can take to defend yourself, such as using a single-purpose email address that you've created only to use with that site. Ultimately you need to decide if the security risks outweigh the benefits to you of being on the site.

share|improve this answer

If you have an "SSO token" then it seems plausible that the token is the culprit. That kind of system is supposed, by design, to automatically "log you in" whenever some authentication is required. As an external system, the token must somehow recognize when a site requests authentication (in order to automatically supply credentials) but also notice when you voluntarily want to "log out", so as to stop logging you in automatically. This recognition process is heuristic in nature; it happens without knowledge of the site itself, and is based on some fuzzy pattern matching on the site contents and behaviour; and it may fail. I believe you observe a situation where it fails. The SSO token does not understand that you really wanted to be logged out, and logs you in again, because it believe that it is its job.

If you have to raise the issue with somebody else, then I suggest that you talk to the supplier for that "SSO token".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.