0

When I use a public computer at a certain location, logging into the workstation and going to a site like gmail.com (to check my email) I find that another user is already logged in. Same happens for facebook.com and many other sites.

I always log the user out on that website, however am I responsible to do anything else? Do I need to notify someone that this issue is occurring regularly and their accounts could be compromised or is it not my issue?

  • What do you mean by "logging into the workstation"? – IQAndreas Nov 20 '14 at 3:52
  • And are these "You are already logged in elsewhere" notices being given to you by Gmail and Facebook? Due to the way web applications work (page requests are served, rather than keeping a connection alive) it's uncommon to see "You are logged in elsewhere" notices on websites. – IQAndreas Nov 20 '14 at 3:55
  • @IQAndreas I mean logging into a computer with my credentials (username and password) provided by the public organization that owns the computers. These notices are not being given to me because I log out after logging in to my email . – alexyorke Nov 20 '14 at 14:53
  • 2
    Ah, I see; I misread the question. The previous user of the computer is still logged into Gmail when you arrive at the computer. – IQAndreas Nov 21 '14 at 5:36
1

I assume that you are referring to various different users, rather than one in particular (given that it is a public computer the chances of it being the same person every time is slim), so I would say that you are already doing the right thing.

It could be tempting to go a little further and try to contact the user(s) and let them know what is happening, but their is a fine line between being helpful and crossing over into unauthorised access (to find out their contact details or using their account to send them a message), which depending on your location might be illegal. Also if someone lacks awareness of the need to logout they may well not understand the advice you try to offer and it could end up being misconstrued and cause you a whole bundle of hassle (I speak from experience!).

Depending on the organisation that has provided the computer, it would probably be worth bringing it to their attention, that way they have the option to make users aware of the need to explicitly log out of sites after use, hopefully they will have some appreciation of the implications and do something to try and raise awareness (though how is dependent on the local setup).

Ultimately though it is down to the individual to be responsible for their actions, there is only so much the rest of us can do.

0

In the situation you describe, a user with malicious intent (not you of course, but someone else with access to that public computer) will not have access to the previous person's password, and will only be able to use the other person's account until the session has expired (this time limit is determined by the website). However, while they are temporarily logged in to another person's account, they can still do some damage: they are still able to read private emails and send spam or emails with malicious attachments. You can do more damage with banking websites, but these usually have very short sessions and extended security measures, such as forcing you to re-enter your password every 15 minutes.

Sadly, I have found that most people (even sometimes the somewhat computer literate) tend to assume if you close the browser window it "exits" the website you were on, not realizing that you can still remain logged in.

This is not a question about authentication, but one of etiquette.

Are you required to do anything? No. But chances are if you find the user doing this once, chances are he doesn't realize he is doing things incorrectly, and is likely doing it all the time. It would be worth educating the user (perhaps sending him a quick email with an explanation) of the need to click the "log out" button when they are finished checking their email or bank account.

Once they learn that they need to log out when they are finished, it will benefit them in the long run.

Also, as a courtesy, I would log out of his account (perhaps even clearing the cookies of the browser on the public computer so as to log everyone out from all sites visited on that computer). That way, if someone with bad intentions comes along later, at least one person is safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.