89

We have grown noticeably accustomed to logging in or signing in to systems and websites in many places.

I know that many sites such as my bank (NetBank) logs me out as soon as I exit the page1; but many and more don't.

In an article which I recently read, the writer states:

This type of authentication maps very naturally to a web site, because users are used to “logging in” when they start working with a particular site and “logging out” when they are done.

But is this actually the case? Do users explicitly log out of sites when they are done?

I know I certainly don't; and I'm a Web/Software Developer2


NOTES:

  • Please provide evidence and/or research as part of your answers (if possible).
  • I ask this as I would like to know whether or not to base my UX design on users' behaviour to ensure their safety.
  • Question is not relevant to non-safety-concerned sites where it doesn't matter if you stay logged in (StackExchange on home computer etc.).
  • According to this answer on a similar question; many sites don't even prominently display the log-out/sign-out button.
  • Another related question: How should a user exit an intranet web app with automatic login?

1. I think that it doesn't kill the session when I leave, but kills any sessions if they exist when I return, making it seem like it kills on page close. Either way, doesn't matter for our discussion.

2. Unless I'm at a public or work computer.

10
  • 2
    Could also be worth considering the environment the user is likely to access the site from. I know my log out behaviour is differs on my home computer from my work computer and again from a public computer.
    – Sheff
    May 12, 2014 at 9:29
  • 4
    May be not directly relevant, but when user want to switch account, normally they will need to logout and login with another username.
    – Bolu
    May 12, 2014 at 10:17
  • 1
    I do. Not from all sites, but most certainly from all security sensitive sites and from all sites that otherwise use all kinds of scripts to collect information about me. Not that it would actually prevent them from still keeping the cookie and only making me believe I have thwarted them, but I sure as heck will try and make it as difficult for them as possible. May 12, 2014 at 12:04
  • Your bank may also expire sessions by time since last activity. I've walked away from mine many times, and come back after a remarkably short time to find it has timed out.
    – RBerteig
    May 12, 2014 at 23:05
  • 1
    Don't think this is answer worthy, as it has no research. However, from my experience, they do not log out for a few main reasons. Most normal users are not really aware of the security risks, and just think "it won't happen to me, so they stay logged in". Also, its more convenient to stay logged in IMO
    – George
    May 13, 2014 at 22:25

8 Answers 8

71

Users do log out conceptually - but not explicitly.

Users have become conditioned to sites managing security on their behalf by automatically logging sessions out. They know this because they are continually having to re-login. As this has become expected behaviour, in their mind leaving a site is 'fine' and log-out 'will happen'.

But actually this "Log-In" / "Log-Out " dichotomy is artificial. Amazon manages this very well in three levels:

  • Unknown user

  • Known user => access non-sensitive actions

  • Known user recently re-authenticated => access sensitive actions

8
  • 5
    I can't +1 this. I do actively and explicitly log out. Not downvoting either because I realize that many users are not as aware of the pitfalls of staying ("partly") logged in. May 12, 2014 at 12:05
  • 8
    @MarjanVenema The question for me is "what is the most common behaviour for unsophisticated users", anecdata from anyone sufficiently competent to have a stack exchange account are just line noise when it comes to planning UX work.
    – Racheet
    May 12, 2014 at 13:32
  • 1
    @Racheet: Hmm, so I am just line noise? No problem, but you may want to rethink that. I am absolutely not the only one who is very alert when it comes to my privacy. May 12, 2014 at 16:15
  • 5
    @MarjanVenema I didn't mean it in a perjorative sense. Sorry if I came across as rude. What I meant to say was that when designing for user experience, it's always best to design a workflow for the user-model of the user you have the most of. Unless you're fog creek software, that user is going to be much less sophisticated than anyone with a stack exchange profile.
    – Racheet
    May 12, 2014 at 17:42
  • 6
    @MarjanVenema In other words: You are the 1%. You'll be able to work out the log-in behaviour of any given web-site with little difficulty. People designing the log-in behaviour need to be thinking about how to make it understandable for everybody else. That's the whole point of UX work. Making interfaces that are usable by people that aren't as smart as us.
    – Racheet
    May 12, 2014 at 17:44
124

Do note that, even if users "expect" most sites to log them out automatically, in certain circumstances (eg. a shared computer at a friend's home/library/Internet café), they will need an explicit "log out" link to assure them their session is terminated and no one else can access their account.

Another valid use case is when users have multiple accounts (husband and wife) and want to switch accounts.

So please always provide an explicit option to "log out".

11
  • 17
    +1 for drawing attention to access via public computers. May 12, 2014 at 12:07
  • 2
    Agree completely. My "implicit logout behaviour" answer was in no ways meant to condone the practise, or suggest that "Log Out" UI was unimportant.
    – Jason A.
    May 13, 2014 at 11:56
  • 6
    While this does provide a good answer as to Why sites should allow users to explicitly log out, it doesn't answer or even address the OP's actual question of Do users log out. May 14, 2014 at 13:42
  • 3
    @Konerak -I don't see where your answer states it's not really important if everyone does it or just 10%. Regardless, I'm not disagreeing with the facts your answer provides. I'm just saying that they don't answer the question that the OP asked. You are answering the question the OP should have asked. Now, I can't really fault you for that because the OP asked a Yes/No question which is why I didn't down vote you. I just think that something should be said in your answer about why you aren't answering the question the OP asked. May 15, 2014 at 13:14
  • 1
    I agree with @CodeMaverick; in that as a Programmer/Web Developer, I already know that users should log-out, and a log-out button must be provided, but I'm just wondering what their behaviour is.
    – Möoz
    Aug 31, 2014 at 22:20
18

I have a web site that offers various services for weddings, so my target audience has pretty diversified technical skills. My unequivocal conclusion after 2 years running the site is users do not log out.

Or they just leave a page open, and then I am logging them out after 10 idle minutes, or (much worse scenario) they just close the tab/the browser with the close button (x).

And then I have to track these "hung" sessions for some time, to make sure that the user is really gone. What a headache! Sometimes I think that the user is gone , but s/he actually is there, just does nothing. Sometimes a user is gone, but I am still thinking that s/he is there, so I prevent opening this account on another computer. An absolute nightmare, but I believe it is a sad reality for any non professional audience - closing by x, no log outs

As I base my conclusion on thousands' users experience, I think this generalization is well substantiated.

5
  • 10
    Why not let them log in from 2 different devices? It's pretty common for me to look at something on my phone or tablet, then decide I want to look at it on the computer. I may need to stay logged in on the phone/tablet to see the address as I'm typing it on the computer. I certainly don't expect to be logged out on one of the devices when I log in on the other one. May 13, 2014 at 13:26
  • 3
    Well, as I do not have Google power behind me, I cannot afford developing Google Docs like system that allows simultaneous editing of a document by multiple users. If you are aware of any 3rd party open source solution to this problem, I will be really grateful.
    – Flot2011
    May 13, 2014 at 14:28
  • 1
    @Flot2011 Just log out the previous session whenever someone else uses the same account on a different device.
    – API-Beast
    May 13, 2014 at 16:50
  • @Flot2011 socket.io If you want to write a real-time app you could check this out. There are also some Javascript frameworks that wrap this functionality, such as Meteor and Derby, but they are not production-ready.
    – randak
    May 13, 2014 at 18:36
  • If you deal with credit cards (e.g. for ecommerce transactions), then PCI-DSS mandates that your sessions expire. Short of compliance frameworks breathing down your neck, you probably have obligations re: privacy legisliation. If there is private information that could be leaked/breached by not expiring sessions/providing logout then one could say you're negligent.
    – straya
    Sep 29, 2021 at 6:25
11

As has been noted above, this depends on the app. But even before the app, this depends on the user. Advanced users adapt their behavior to the specific app, based on a balance between the app's sensitivity and their own paranoia security awareness, like @Goodwine described.

Beginners do not log out. I've spoken to a number of not very computer-savvy people in theirs sixties who were at a complete loss when they tried logging into their email account from somebody else's computer and it had asked them for their password. As they usually put it, "this computer doesn't have my email". They had forgotten that they even had a password, and the concept of logging in was foreign to them. This because they never log out at home, they know that they have to click a bookmark in their browser ("in The Internet") and their email is there waiting for them. This goes for often-used apps, like email.

In more rarely-used apps, like online banking, they are well aware of the concept of logging in, because the app takes care to log them out after a period of inactivity or when they close their browser. But they still don't log out - they're both uneducated about information security, and they aren't aware that there's a "session" going on. When they're done they just close the browser, because they're done - they've completed all the actions they needed to do. Logging out is a "meaningless" purely technical action, it's not part of their "to-do list".

8

It depends on the website / application

They do

I can tell you that users DO log out, specially when there is a poor management of user accounts on a PC. I have seen people who share their PCs with their family, but do not have multiple users, so they have to keep logging out when they access the same systems (Say... same email provider), and when they want to protect their privacy (Say... a social network).

Also, I used to work (a long time ago) in a company that outsourced Customer Service, and we shared PCs, with the same user, it was an anarchy! We had to keep logging out every time we left the PC alone, because the next user could have a malicious intent.

They Don't

There are certain services that I don't really care if someone gained access to because "I left my account logged in", such as Netflix, or YouTube. And the same family that I was talking about before doesn't log out from those either, they don't really care, because there is no sexting to be exposed from a social network's private messages, or because it is not a "personal" service like an email service.

In Conclusion

I know that you have your own user in a PC, but think about those who don't.

It's all about the content of the application. Do you care if others look at it? What would happen if it is exposed? is it THAT popular so that it would be used by everyone sharing that PC?

Now. Please note this: it is a relatively small group of people. So it would be OK to be able to access to the log out from a menu quickly, say... 2-clicks away (do not uber-hide it), but it should not be super exposed.

2
  • Interesting thought on certain services such as Netflix. Specifically, Netflix is not the best example since other persons have a different taste and rate movies different - so the recommender algorithm doesn't work as well anymore.
    – M.Mimpen
    May 14, 2014 at 12:31
  • Netflix has a "change users" button at the top of every page now, allowing you to swap sessions with the other profiles on your account. So if your spouse/sibling/child wants to use Netflix after you, they just need to choose their name from the profiles list with no password prompt.
    – CyberSkull
    May 18, 2014 at 23:51
4

In my current role, the users who I interact with are mostly system administrators. They generally do log out of applications (websites, web apps, desktop apps) when they are done using them. If it's the middle of the day and they're simply stepping away from their workstation for a few minutes, then they will rely on locking their workstation. If they're stepping away for longer than that, whether they logout is correlated to how long they're stepping away. A short lunch is less likely to result in a logout, leaving at the end of the day is definitely a logout.

4

Most users with college level age and experience, do not log out on their personal computer, and often do not log out on public computers.

I participate in many Facebook groups comprised of users with approximately a college level age and experience. Very frequently, a 3rd party will post on their wall something mildly funny and or embarrassing because the 3rd party came across a computer that was logged into the 'victims' Facebook account. This happens so frequently, that it has its own slang term, which is 'hacked'. Side note: this is an unfortunate slang term because it clouds the actually meaning of that word, and makes it seem more harmless.

Most kiosks and workstations at my college, to prevent that security issues with email and department logins, now use a per user login that resets all cache, cookies, and sessions on the computer whenever a user logs out. When using stable, or less public lab computers, many users treat it as an annoyance that the previous user did not log out of their sites, making the next user in line do extra 'work' to complete that step.

I have borrowed many a laptop in college and usually could have complete access to most of the owners sites.

This is a narrow sample size but I think illustrates common behavior. And if security concerns are treated this lightly for 'digital natives' (however much we dislike that term) we can anticipate that things are worse with those of less digital experience.

3

It is correct to say it depends on their risk, and the usability of the site. I was a NetBank early adopter, and have used used it since before it was a browser application. I cannot share any hard facts with you, as I am an ex-CBA employee. In earlier years it was possible to have multiple concurrent logons in multiple tabs on the same browser. Thus it was easier to jump between "identities". Closing this functionality forces family members to logout and login explicitly between sessions (and so you should). Some do and some don't, the ones that do tend not to have their family/housemates steal from them, which frankly happens.

Since this change, a much higher percentage "do", although this is arguably the polite thing to do when relinquishing the keyboard.

(It certainly cuts down the total number of active sessions, which is always desirable from a performance point of view, sadly this is likely the driver for the timeout period, which will be shorter during peak loads).

Some people will consider "what's the worst that could happen" and behave accordingly, other people are exploit fodder.

These matters are over and above the perils of keystroke logging, password (and account) sharing and phishing forms.

1
  • CBA certainly aren't known for their security controls!
    – straya
    Sep 29, 2021 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.