2 added 79 characters in body
source | link

When logging in to a web service, a cookie is planted in your browser. This cookie has a unique ID value that identifies you while you're using the web service, and, possibly, when you come back later. If, somehow*, that identifier was stolen, the person possessing it could, possibly, use your account as if he was you.

Logging out, usually, invalidates this identifier for both you and the adversary. Neither of you will be able to use the identifier to tell the web service "Hi, I'm Angelo Hannes". That has the unfortunate side effect of forcing you to enter your username and password again to login.

"So, what should I do, then?", you ask. Well, it depends. Some sensitive web services (banking, government websites, insurance companies, etc.) have a short session time, i.e. they invalidate the identifier after 10-15 minutes of not using the service. Other sensitive web services (email inbox, which basically controls almost all of your other accounts) don't really invalidate the session that often, but they apply IP address restrictions (if you use the same session from a different IP address, the session is invalidated).

TL;DR

  • Public computer, extra paranoid, or you think your session was compromised, or you really care about this service? Logout.

  • Private computer and, you think your session is safe, and you really don't care about this service? It's okay to stay logged in.


* Your session can be stolen using known issues in the service (not using HTTPS, for example) or some zero-day vulnerabilities such as a newly discovered XSS attack in the service, a new vulnerabilities in your browser that discloses cookie information, or some malware installed on the computer you're using that steals session information (well, in that case it would have already stolen your username and password).

When logging in to a web service, a cookie is planted in your browser. This cookie has a unique ID value that identifies you while you're using the web service, and, possibly, when you come back later. If, somehow*, that identifier was stolen, the person possessing it could, possibly, use your account as if he was you.

Logging out, usually, invalidates this identifier for both you and the adversary. Neither of you will be able to use the identifier to tell the web service "Hi, I'm Angelo Hannes". That has the unfortunate side effect of forcing you to enter your username and password again to login.

"So, what should I do, then?", you ask. Well, it depends. Some sensitive web services (banking, government websites, insurance companies, etc.) have a short session time, i.e. they invalidate the identifier after 10-15 minutes of not using the service. Other sensitive web services (email inbox, which basically controls almost all of your other accounts) don't really invalidate the session that often, but they apply IP address restrictions (if you use the same session from a different IP address, the session is invalidated).

TL;DR

  • Public computer, extra paranoid, or you think your session was compromised? Logout.

  • Private computer and you think your session is safe? It's okay to stay logged in.


* Your session can be stolen using known issues in the service (not using HTTPS, for example) or some zero-day vulnerabilities such as a newly discovered XSS attack in the service, a new vulnerabilities in your browser that discloses cookie information, or some malware installed on the computer you're using that steals session information (well, in that case it would have already stolen your username and password).

When logging in to a web service, a cookie is planted in your browser. This cookie has a unique ID value that identifies you while you're using the web service, and, possibly, when you come back later. If, somehow*, that identifier was stolen, the person possessing it could, possibly, use your account as if he was you.

Logging out, usually, invalidates this identifier for both you and the adversary. Neither of you will be able to use the identifier to tell the web service "Hi, I'm Angelo Hannes". That has the unfortunate side effect of forcing you to enter your username and password again to login.

"So, what should I do, then?", you ask. Well, it depends. Some sensitive web services (banking, government websites, insurance companies, etc.) have a short session time, i.e. they invalidate the identifier after 10-15 minutes of not using the service. Other sensitive web services (email inbox, which basically controls almost all of your other accounts) don't really invalidate the session that often, but they apply IP address restrictions (if you use the same session from a different IP address, the session is invalidated).

TL;DR

  • Public computer, extra paranoid, you think your session was compromised, or you really care about this service? Logout.

  • Private computer, you think your session is safe, and you really don't care about this service? It's okay to stay logged in.


* Your session can be stolen using known issues in the service (not using HTTPS, for example) or some zero-day vulnerabilities such as a newly discovered XSS attack in the service, a new vulnerabilities in your browser that discloses cookie information, or some malware installed on the computer you're using that steals session information (well, in that case it would have already stolen your username and password).

1
source | link

When logging in to a web service, a cookie is planted in your browser. This cookie has a unique ID value that identifies you while you're using the web service, and, possibly, when you come back later. If, somehow*, that identifier was stolen, the person possessing it could, possibly, use your account as if he was you.

Logging out, usually, invalidates this identifier for both you and the adversary. Neither of you will be able to use the identifier to tell the web service "Hi, I'm Angelo Hannes". That has the unfortunate side effect of forcing you to enter your username and password again to login.

"So, what should I do, then?", you ask. Well, it depends. Some sensitive web services (banking, government websites, insurance companies, etc.) have a short session time, i.e. they invalidate the identifier after 10-15 minutes of not using the service. Other sensitive web services (email inbox, which basically controls almost all of your other accounts) don't really invalidate the session that often, but they apply IP address restrictions (if you use the same session from a different IP address, the session is invalidated).

TL;DR

  • Public computer, extra paranoid, or you think your session was compromised? Logout.

  • Private computer and you think your session is safe? It's okay to stay logged in.


* Your session can be stolen using known issues in the service (not using HTTPS, for example) or some zero-day vulnerabilities such as a newly discovered XSS attack in the service, a new vulnerabilities in your browser that discloses cookie information, or some malware installed on the computer you're using that steals session information (well, in that case it would have already stolen your username and password).