1

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why this feature should be implemented? How does it make it more secure?

2

From the perspective of a developer who recently has to implement such a feature, another possibility is to prevent the users shooting themselves in the feet.

Many custom/internal applications have very specific workflows and store a lot of state in the session. If the user abandoned some work halfway on one computer, finishes it somewhere else and return to the original computer, he/she may get confused about the unifinished work. If the user incorrectly chose to continue, then the original results may be overwritten / duplicated.

It is of course possible to improve the code to make this less likely, but for an internal app, the most cost effective way is to prevent concurrent logins.

  • I disagree with you : the session is not so difficult to be stored on a server-side nowdays, and if it's just difficult to make a memcached query, for example, it's pretty weird. – Alexey Vesnin Feb 18 '16 at 18:57
  • @AlexeyVesnin It's not (just) about storing and retrieving session data, but the extra work of creating the UI/procedure to let the users discover and restore an abandoned process (and stop the work on the original host) and the training around it. Many organisations will not justify this cost and would go with one session/concurrent process only. – billc.cn Feb 18 '16 at 19:13
  • 2
    Agreed, an "economy-driven" code ensimplification is taking place, yes - but IMHO it's wrong and it's a very BAD practice – Alexey Vesnin Feb 18 '16 at 19:15
1

The most common case is that the login is used as a workplace accounting token, i.e. "check how much time you're working on PC". The more logical reason, but it's not easy to see from a first sight, is that you simply physically can't be on the two geografically isolated places at the same time.

  • remote desktop? – Kris C Feb 18 '16 at 17:48
  • I guess so.. but I think whether if the desktop is remote or not does not affect it also haha – XbatbatX Feb 18 '16 at 18:05
  • @XbatbatX sure it isn't : it will be unneccesserily laborious to check a desktop's geolocaton EVERY time when you need to auth someone to log into a PC =) So it's just set globally – Alexey Vesnin Feb 18 '16 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.