Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It seems that every single banking & financial website that I have used logs me out after a certain period of time.

Are there a legal requirements or technical reasons for financial sites to do this? Or is this just their form of "security" to prevent others from accessing your account should you forget to logoff or secure your computer or device?

This is very poor user experience in my opinion. Google does not log me out after such a short period of time, and I feel that my Google account with 2-Step Verification and a legion of extremely intelligent engineers is far more secure than my banking accounts.

It seems I should be able to choose whether these sites log me out automatically, or if I may stay logged in for a reasonable period of time (30 - 90 days being common for other sites).

Edit:

I believe the selected answer is the most complete answer to the question, but none of the reasons seem to be good reasons for banks to end your session.

There are a couple of levels of risk associated with an attacker gaining access to your banking website session:

  1. viewing your private (financial) information
  2. modifying your account (this includes stealing money, locking you out, etc.)

This same situation exists on any website account, but for financial websites, and for most people, #2 is far more severe than for other types of sites.

I think a better solution than logging users out would be to:

  1. default the session timeout to a short duration
  2. allow the user to change the session timeout for his/her account
  3. require re-authentication for actions that modify the account or move money around
share|improve this question
1  
If you choose to stay logged in for 90 days, and your life savings get stolen, are you going to accept the fault and be okay with not getting any of that money back? Or are you going to - regardless of the fact it was your misinformed choice that caused the issue - expect your bank to resolve the issue, give your money back, and take the huge PR hit involved with an account being compromised? –  Anthony Grist Apr 3 at 14:47
    
As I mentioned above, any changes that modify your account - such as moving money out of it - should (re)require your authentication. –  mkopala Apr 3 at 20:35

3 Answers 3

up vote 6 down vote accepted

It's for your security. This way people can't accidentally stay logged into their account, so anyone with access to your computer has full access to your bank account.

This way thieves don't have motivation to break into your house to steal your computer not just for the value of the computer, but potentially to get access to your life's savings and use it to purchase items, transfer funds out of the country, etc. (Yes, they could break in, install keyloggers, and potentially do the same attack.)

Power gmail users will check their email accounts hundreds of times a day; having to re-log in every time would be overly burdensome. Your bank account you only need to log in rarely; maybe for 10 minutes once a week or month.

The potential repercussions of a stolen bank account is typically more severe to the average user than the repercussions of having your email account stolen.

Not to say that losing your email account can't have severe repercussions as well (especially if you can use your email to reset passwords, use as part of 2-factor authentication, use for social engineering, etc.)

share|improve this answer

Session expiry is incorporated into applications to safeguard the user from session hijacking or cookie thefts.

Not all users are tech savvy and might not understand what session hijacking or cookie thefts are.So forcing the users to login every few minutes of inactivity is for safeguarding the users information.

Banking applications use cookies and sessions to maintain the user state and security. Inactivating the cookies after few mintues of idle time makes it impossible for the hacker who stole the cookie to login too.

share|improve this answer
    
This doesn't address the question of why banks & financial websites specifically do this. –  mkopala Apr 3 at 20:40
1  
@mkopala Nobody is going to come to Google asking them to give them back thousands of dollars. –  emodendroket Sep 9 at 19:02

As well as the above answers, it's also to prevent people hopping onto your computer if you're away from your machine.

For example, if Bob signs into his online banking in his workplace, then decides to grab a coffee without locking his workstation first; then anyone could walk past and jump straight into his bank account.

With the X minute expiration/log out, this problem is greatly reduced if Bob gets distracted with other tasks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.