Tell me more ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.
up vote 5 down vote favorite

Or put another way - is there a process for deciding how long a user's authenticated session should last?

share|improve this question

2 Answers

up vote 1 down vote accepted

I don't agree with Edgarator that you should ask the user, especially not at log in.

It is all very nice and well to allow the user to change it, but don't ask them to make a decision that is totally unrelated to what they want to achieve with your application.

Decide a sensible default for yourself - possibly using the criteria Edgarator shows in his answer. Make it short-ish. And DO provide option to change it longer in some settings dialog.

share|improve this answer
+1 agree: at login time it is completely useless. I personaly like my eBanking client: shows countdown from 20 minutes in upper right corner to session expiration. with button to start over. and any operation resets the counter too. the point is: user knows on every page how long will session last and he has no option to change predefined amount. but it is determined by sensitivity - eBanking. for other purposes it may be few hours or days... – Frantisek Kossuth Sep 18 '12 at 15:18
I don't think you read well my answer, but I appreciate the comment. I'm suggesting to the OP to learn about his/her audience by running a test and tracking, giving that there are thousands of different scenarios, and providing a set of questions to start off. – edgarator Sep 18 '12 at 16:23
@edgarator: I read it well enough, and I agree with testing, and your comments regarding sensitivity of data being a factor in the length to be chosen. I just strongly object to asking the user to decide, especially in the login screen as shown in your mock up. – Marjan Venema Sep 18 '12 at 18:09
up vote 1 down vote

It would be difficult to find a standard time to measure how often to expire a session in a mobile device.

So, what I would do is:

  1. Define what's my user
  2. How sensitive the information I'm dealing with is

1. To define the user

You might want to think around the lines of:

  • Is he security conscious?
  • Does he need quick and easy access to the application? (perhaps older people would get annoyed by having to type a password with symbols, uppercase and lowercase with at least 8 characters every time).
  • Would making it difficult to login a burden for adoption or my application would be needed regardles of how difficult is to log in?

If this doesn't matter perhaps you could add different session expiry settings at the beginning and learn (by tracking it on your server) from your user how often your standard user like the session to be expired. For example:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

2. To define how sensitive the information is:

Pretty much all legal implications here:

  • Think about what would happen if your information gets lost?
  • Should I take care of my user (beyond providing the means for a secure connection), or
  • Should I let the user deal with the consequences of device mishandling?

More on this

  • Mobile Applications such as Facebook don't care much about expiring the session on mobile devices due to the fact that it would stop people from using it A LOT.
  • Mobile Applications like GMail would expire the session every once in a while, so that you don't get annoyed by it if it happens every blue moon, but still if someone breaks into your phone, they wont have unlimited access to do eavesdropping on your phone.
  • Mobile Applications such as Online Banks would expire the session after closing the application, as unwanted transactions could be made, and that could affect the bank itself. Also, on this, a security aware user is most likely to start saying that the app is no good due to the fact that it lack security.
share|improve this answer
I think the question was "how long", not "how" to keep session. I am interested too. – Frantisek Kossuth Sep 18 '12 at 7:39
Thanks @FrantisekKossuth, I think I'll rephrase it. What I was trying to say is that Facebook has unlimited session time on its mobile application, Google will expire the session after two weeks and a Bank will expire it immediately. As it depends entirely on who own the data and what potential impact it has if the data gets stolen. What I was trying to imply with my answer is that there's no single answer to this question as it's dependent on the audience and the information being handled. So the question is to broad to answer. – edgarator Sep 18 '12 at 7:52
Don't ask the user at login. Decide for yourself. Make it short-ish. Provide option to make it longer in some settings dialog. – Marjan Venema Sep 18 '12 at 8:37
1  
Thanks for your comprehensive response, @edgarator. I agree there isn't any standard for this, but it appears that the main factor is sensitivity of data available in the app. About Facebook, my guess is that it prioritizes engagement over security. – mariachimike Sep 18 '12 at 10:38
@MarjanVenema I think providing options with a sensible default (validated over time) is the broadest solution. You should add that as an answer. – mariachimike Sep 18 '12 at 10:39
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.