Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I'm wondering why do we need to ask user to make a decision, for how long he want to be authenticated? This is done by having "keep me signed in" option login page:

enter image description here

Why can't we simply "predict" how long user wants to be authenticated. For example, 1. User Logged in for first time - 20 min session timeout 2. User's session was expired after 20 min, so he logged in for second time (during next hour after expiration). This means user work with website frequently, so we can extend his next session to 40 min 3. Another use case. We know that user works with our app at least 3 hours a day, so his session expiration time is 3 hours. But now he logging in from unknown/new computer. Let's consider it as a public computer and set session time 20 min (instead of 3 hours).

So, what I'm trying to say is that label "keep me logged in" doesn't describe for how long will user be kept logged in. Also it doesn't describe whether session will be ended when user close the browser window or not.

In addition, website could learn user's habits and learn that some users use web site during their work day from 8am to 5pm. So it may keep them signed in during this timeframe. If user will try to come at 6pm - ask him credentials, but if he comes next day at 8am - don't ask him login/password.

Does it make sense?

share|improve this question
1  
Yes you can. A "keep me logged in" option shouldn't suffer from a time-out. It should keep you logged in forever. Period. Only deviation is a periodic re-checking that it is you by having you re-enter your password like Google Mail does once every couple of weeks (not hours!). Providing a "keep me logged in" feature and then logging/timing someone out... If I no longer want to be kept logged in, I simply log out (which should clear the keep me logged in feature for the subsequent login). –  Marjan Venema Jun 8 '12 at 6:15
    
It doesn't make sense from a security standpoint as you'd be implicitly opening up a large variety of security loopholes and undesired behavior. –  zzzzBov Jun 8 '12 at 15:51

5 Answers 5

up vote 10 down vote accepted

The main reason for that, IMO, is if the user is logging in from a location that is not necessarily their home or normal one - public computer, friends house, etc.

By not "remembering me" I signify that I don't want the site to remember my username making it easier for someone to guess my user ID and pass.

Yes, I should log out, but what if I forget? Closing the browser should enable me to get logged out.

share|improve this answer
    
Don't you think that "forget to logout" and "forget to close browser window" have the same probability? –  Paul Podlipensky Jun 7 '12 at 21:34
4  
Not at all. Closing the browser when you are done is a mindless action, and is done automatically for you by the operating system under many situations. Logging out is a very conscious action that is easily avoided/forgotten. How evident is a the "Sign Out" option on most sites? They are often small, out of place and sometimes hidden (e.g., Gmail, or this site) making it very easy to forget. –  Evil Closet Monkey Jun 7 '12 at 21:43

There could be a lot of reasons that you would want or not want a "Remember Me" functionality. Typically, it is for convenience. It is so the user either doesn't have to remember or enter either their username and/or password. It usually depends on the application/website itself.

Though I really like the idea of a smart-log in design, it is really hard to predict users patterns. Sometimes they log in to just get an update. Sometimes they log in to enter in data. So, in other words, some are read only work flows while others are read/write work flows. Each might have separate security requirements. When that is the case, you always pick the most secure method. Some scenarios only remember user while others remember both username and password. Obviously one is more secure than the other.

Basically, what I am trying to say is that user predictions can very depending on security requirements, time of the day, date, mood, etc. making it very hard to accurately predict their habits. However, you seem to have identified some basic cases.

All that being said, one really important factor you need to weigh in is the user experience. Sometimes consistency trumps smart/dynamic patterns. To put it simply, if a user has a different experience each time the they log in, it might not be a good user experience. Now, the user is caught trying to figure out when or how long they are logged in to your site.

Maybe you need to ask yourself if the great idea you have, which I think it is, is worth the possible confusion that it might bring to your user. Everyone generally does it a certain way. Though I don't want to snuff out your "outside of the box" thinking, which I love, considering having log in act consistent not only on your site, but others they visit, might be more important.

Have fun deciding. Hope that helps. Have a fantastic day!

share|improve this answer

As Tha Riddla points out, one of the more important points of this checkbox is to make sure that a username and/or password is not saved on the computer -- such as in the situation where it is a publicly accessible machine without accounts (e.g., library computer).

Such boxes do imply that they will keep you logged in indefinitely, even after closing the browser. Although I have run into many sites where they keep you logged in for a few weeks (or so) and then log you out no matter how often you visit.

Adding a predictive auto-login is an interesting concept, but does have a few downsides I can see. Security is the largest -- on a publicly accessible computer, for example, having a website assume it is me because I've been there every day for the past week is not appropriate. One Offs are a minor annoyance -- because I normally log in between 8am-5pm doesn't mean I can't log in later, and doesn't mean I necessarily want to log in again.

I believe the boxes are the appropriate solution; provided they do what they say. "Keep me logged in" means I don't have log in again... ever (on the given computer)... unless I log out on my own. The trouble comes when a website creates an abstract logic, hidden to the user, as to how long that will be.

Creating such a hidden predictive logic may cause similar confusion and annoyance to users trying to figure out why they sometimes have to log in and why not.

share|improve this answer
    
I agree. I think the behaviour of the auto-log in you (Paul) propose is interesting, but it is too hard for a user to predict what is happening. I find it unlikely that his mental model of why he has to log-in or not is going to fit how the application actually works. That is going to lead to frustration. –  André Jun 8 '12 at 13:17

I think you need to keep the model as simple as you can with visual feedback if possible.

Your predictive model would be frustrating precisely because it is hidden from the user. Worse still it changes over time.

Perhaps one of the issues here is that the "keep me signed in" option is not actually accurately representing the reason for authentication - it should say "remember me" as many sites do.

share|improve this answer
    
Welcome to UX! I noticed your good edits :) Keep it up! I edited out your signature, we tend to edit them out since your signature is the signature block at the end of your post. –  Ben Brocka Jun 8 '12 at 1:57
    
Cheers Ben ... am excited by having a place to learn like this. I was a "expert" on concept feedback which at one point was a real learning environment for UX/UI folk. I think this site has the potential to do similar. –  Lisa Tweedie Jun 8 '12 at 8:12
    
I've certainly learned a lot on the site myself :) –  Ben Brocka Jun 8 '12 at 13:02

There are a few effects caused by "remember me" or "are you at a public location?" (which has the opposite meaning of "remember me")...

  • Should closing browser automatically cause sign out
  • Should browser remember user name (can be email address) after log out

There are several reasons that these effects are required...
(Some have already by mentioned in other answers or comments.)

Reasons for sign out:

  • Users do not always remember to sign out, especially since on personal computers they do not need to.
  • Sign out option is not always in a place that stands out (in fact, some times it is hidden behind the user name).
  • Signing out may not be possible (if computer shuts down due to power cut, or OS logs out due to Internet caffee time out and various other reasons)

Reasons for forgetting user name:
(Whether user signs out or it was done automatically.)

  • If you are using a public computer, you don't want others to see your user name (or email address) because
    • Some one may try to hack you account
    • Your address could be used for spam
  • If you are using a friend's computer, your friend probably doesn't want to have to choose from his/her accounts and yours in order to login (without typing in user name explicitly).
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.