4

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as often as I reopen the browser and want to browse within my private accounts.

I do that because I've always supposed that such a method is the very safest, since I hope it protects me from running the risk to have my saved passwords stolen.

But I wonder if it could involve some other kind of risks and how much I should worry about (for example I refer to the possibility that an unwanted kaylogger could read my passwords while they are being typed on the keyboard, and that such a risk becomes higher the more frequently I do log, if I guess correctly how a keylogger basically works).

I'm worried abut other kind of scenarios which I'm unware of, as well.

Which is the safer method? -> Should I Keep my accounts logged in or should I not?

  • 1
    Sites that keep you logged in do not save your password in your browser so staying logged in doesn't risk password exposure. – Neil Smithline Jan 29 '16 at 17:25
3

Risks of keeping logged in:

  • CSRF and XSS attacks could be used to compromise your sessions, if the site in question is vulnerable.
  • If the application uses weak or predictable session tokens, yours could be brute forced.
  • A physical attack (e.g. laptop stolen), could possibly allow access to all your logged in sessions. This could be mitigated using disk encryption, or if using a browser that encrypts cookies like Chrome it can be mitigated with a strong password on your OS account. Both mitigations assume your laptop is locked/logged out at the time of attack, preferably logged out to prevent cold boot attacks from reading the key from memory.

Risks of typing the password each time:

  • You may be vulnerable to phishing unless you diligently check the domain and the HTTPS padlock each time.
  • Keyloggers may get your password, although if they do this your machine is compromised therefore you've already lost.

I would suggest the use of a browser based password manager to mitigate phishing, as your password will only be filled if the domain matches, although I've not seen any yet that protect against ssl strip style attacks (that is, they validate the domain, but not that the protocol is HTTPS).

Risks of a password manager:

  • If they autofill password boxes without prompting, an XSS attack could grab the password should the site be vulnerable.
  • You're trusting software or service with your keys to the kingdom.
  • You could be at mercy to any vulnerabilities in the client-software or server-side storage (if applicable).
  • All your eggs could be in one basket should your master password be compromised.
  • It's not about staying logged in. He would still logout after each session use. I'd think he is talking about saving the password in browser vs manually typing it each time. – Pacerier Jan 29 '16 at 15:24
  • 1
    @Pacerier: The OP stated I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected – SilverlightFox Jan 29 '16 at 15:26
  • Yes I've read that too. But it doesn't correspond with what he wrote before that. Reading the whole essay as one piece, my conclusion is as above. (And he's clearly not a native speaker of English.) – Pacerier Jan 29 '16 at 15:27
  • 1
    @robertalrp: You should be pretty safe with Facebook and Amazon. Yes, it would be less popular sites that would more likely to have session management flaws. – SilverlightFox Jan 29 '16 at 16:15
  • 1
    @rob Something like LastPass. – SilverlightFox Feb 6 '16 at 12:55
1

Not staying logged in increases the potential damage a keylogger could do. Also your passwords are going to be much more simpler because you need to recall them all the time.

Staying logged in increases the damage a session stealer could inflict.

The latter is only usable if the attacker is in the same network. If you are always in your own, safe network, I would stay logged in both for convenience and because the risk is negligible.

Both threats are easy to avoid if you keep your system updated, don't install random crapware and don't open strange attachments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.