Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

We have grown noticeably accustomed to logging in or signing in to systems and websites in many places.

I know that many sites such as my bank (NetBank) logs me out as soon as I exit the page1; but many and more don't.

In an article I recently read the writer states:

This type of authentication maps very naturally to a web site, because users are used to “logging in” when they start working with a particular site and “logging out” when they are done.

But is this the case? Do users log out of sites when they are done?

I know I certainly don't; and I'm a Web/Software Developer2

NOTES:

  • Please provide evidence and/or research as part of your answers (if possible).
  • I ask as I would like to know whether or not to base my UX design on users' behaviour to ensure their safety.
  • Question is not relevant to non-safety-concerned sites where it doesn't matter if you stay logged in (StackExchange on home computer etc.).
  • According to this answer on a similar question; many sites don't even prominently display the log-out/sign-out button.
  • Another related question: How should a user exit an intranet web app with automatic login?

1. I think that it doesn't kill the session when I leave, but kills any sessions if they exist when I return, making it seem like it kills on page close. Either way, doesn't matter for our discussion.

2. Unless I'm at a public or work computer.

share|improve this question
2  
Could also be worth considering the environment the user is likely to access the site from. I know my log out behaviour is differs on my home computer from my work computer and again from a public computer. –  Sheff May 12 at 9:29
4  
May be not directly relevant, but when user want to switch account, normally they will need to logout and login with another username. –  Bolu May 12 at 10:17
1  
I do. Not from all sites, but most certainly from all security sensitive sites and from all sites that otherwise use all kinds of scripts to collect information about me. Not that it would actually prevent them from still keeping the cookie and only making me believe I have thwarted them, but I sure as heck will try and make it as difficult for them as possible. –  Marjan Venema May 12 at 12:04
    
Your bank may also expire sessions by time since last activity. I've walked away from mine many times, and come back after a remarkably short time to find it has timed out. –  RBerteig May 12 at 23:05
1  
Don't think this is answer worthy, as it has no research. However, from my experience, they do not log out for a few main reasons. Most normal users are not really aware of the security risks, and just think "it won't happen to me, so they stay logged in". Also, its more convenient to stay logged in IMO –  George May 13 at 22:25

8 Answers 8

up vote 62 down vote accepted

Users do log out conceptually - but not explicitly.

Users have become conditioned to sites managing security on their behalf by automatically logging sessions out. They know this because they are continually having to re-login. As this has become expected behaviour, in their mind leaving a site is 'fine' and log-out 'will happen'.

But actually this "Log-In" / "Log-Out " dichotomy is artificial. Amazon manages this very well in three levels:

  • Unknown user

  • Known user => access non-sensitive actions

  • Known user recently re-authenticated => access sensitive actions

share|improve this answer
2  
I can't +1 this. I do actively and explicitly log out. Not downvoting either because I realize that many users are not as aware of the pitfalls of staying ("partly") logged in. –  Marjan Venema May 12 at 12:05
7  
@MarjanVenema The question for me is "what is the most common behaviour for unsophisticated users", anecdata from anyone sufficiently competent to have a stack exchange account are just line noise when it comes to planning UX work. –  Racheet May 12 at 13:32
1  
@Racheet: Hmm, so I am just line noise? No problem, but you may want to rethink that. I am absolutely not the only one who is very alert when it comes to my privacy. –  Marjan Venema May 12 at 16:15
5  
@MarjanVenema I didn't mean it in a perjorative sense. Sorry if I came across as rude. What I meant to say was that when designing for user experience, it's always best to design a workflow for the user-model of the user you have the most of. Unless you're fog creek software, that user is going to be much less sophisticated than anyone with a stack exchange profile. –  Racheet May 12 at 17:42
5  
@MarjanVenema In other words: You are the 1%. You'll be able to work out the log-in behaviour of any given web-site with little difficulty. People designing the log-in behaviour need to be thinking about how to make it understandable for everybody else. That's the whole point of UX work. Making interfaces that are usable by people that aren't as smart as us. –  Racheet May 12 at 17:44

Do note that, even if users "expect" most sites to log them out automatically, in certain circumstances (eg. a shared computer at a friend's home/library/Internet café), they will need an explicit "log out" link to assure them their session is terminated and no one else can access their account.

Another valid use case is when users have multiple accounts (husband and wife) and want to switch accounts.

So please always provide an explicit option to "log out".

share|improve this answer
16  
+1 for drawing attention to access via public computers. –  Marjan Venema May 12 at 12:07
2  
Agree completely. My "implicit logout behaviour" answer was in no ways meant to condone the practise, or suggest that "Log Out" UI was unimportant. –  Jayfang May 13 at 11:56
    
+1 I couldn't begin to tell you how many times I've gone to check my email only to be realize my wife's account is the one signed in. –  Dryden Long May 13 at 18:08
5  
While this does provide a good answer as to Why sites should allow users to explicitly log out, it doesn't answer or even address the OP's actual question of Do users log out. –  Code Maverick May 14 at 13:42
3  
@Konerak -I don't see where your answer states it's not really important if everyone does it or just 10%. Regardless, I'm not disagreeing with the facts your answer provides. I'm just saying that they don't answer the question that the OP asked. You are answering the question the OP should have asked. Now, I can't really fault you for that because the OP asked a Yes/No question which is why I didn't down vote you. I just think that something should be said in your answer about why you aren't answering the question the OP asked. –  Code Maverick May 15 at 13:14

I have a web site that offers various services for weddings, so my target audience has pretty diversified technical skills. My unequivocal conclusion after 2 years running the site is users do not log out.

Or they just leave a page open, and then I am logging them out after 10 idle minutes, or (much worse scenario) they just close the tab/the browser with the close button (x).

And then I have to track these "hung" sessions for some time, to make sure that the user is really gone. What a headache! Sometimes I think that the user is gone , but s/he actually is there, just does nothing. Sometimes a user is gone, but I am still thinking that s/he is there, so I prevent opening this account on another computer. An absolute nightmare, but I believe it is a sad reality for any non professional audience - closing by x, no log outs

As I base my conclusion on thousands' users experience, I think this generalization is well substantiated.

share|improve this answer
9  
Why not let them log in from 2 different devices? It's pretty common for me to look at something on my phone or tablet, then decide I want to look at it on the computer. I may need to stay logged in on the phone/tablet to see the address as I'm typing it on the computer. I certainly don't expect to be logged out on one of the devices when I log in on the other one. –  user1118321 May 13 at 13:26
3  
Well, as I do not have Google power behind me, I cannot afford developing Google Docs like system that allows simultaneous editing of a document by multiple users. If you are aware of any 3rd party open source solution to this problem, I will be really grateful. –  Flot2011 May 13 at 14:28
1  
@Flot2011 Just log out the previous session whenever someone else uses the same account on a different device. –  API-Beast May 13 at 16:50
    
@Flot2011 socket.io If you want to write a real-time app you could check this out. There are also some Javascript frameworks that wrap this functionality, such as Meteor and Derby, but they are not production-ready. –  randak May 13 at 18:36

As has been noted above, this depends on the app. But even before the app, this depends on the user. Advanced users adapt their behavior to the specific app, based on a balance between the app's sensitivity and their own paranoia security awareness, like @Goodwine described.

Beginners do not log out. I've spoken to a number of not very computer-savvy people in theirs sixties who were at a complete loss when they tried logging into their email account from somebody else's computer and it had asked them for their password. As they usually put it, "this computer doesn't have my email". They had forgotten that they even had a password, and the concept of logging in was foreign to them. This because they never log out at home, they know that they have to click a bookmark in their browser ("in The Internet") and their email is there waiting for them. This goes for often-used apps, like email.

In more rarely-used apps, like online banking, they are well aware of the concept of logging in, because the app takes care to log them out after a period of inactivity or when they close their browser. But they still don't log out - they're both uneducated about information security, and they aren't aware that there's a "session" going on. When they're done they just close the browser, because they're done - they've completed all the actions they needed to do. Logging out is a "meaningless" purely technical action, it's not part of their "to-do list".

share|improve this answer

It depends on the website / application

They do

I can tell you that users DO log out, specially when there is a poor management of user accounts on a PC. I have seen people who share their PCs with their family, but do not have multiple users, so they have to keep logging out when they access the same systems (Say... same email provider), and when they want to protect their privacy (Say... a social network).

Also, I used to work (a long time ago) in a company that outsourced Customer Service, and we shared PCs, with the same user, it was an anarchy! We had to keep logging out every time we left the PC alone, because the next user could have a malicious intent.

They Don't

There are certain services that I don't really care if someone gained access to because "I left my account logged in", such as Netflix, or YouTube. And the same family that I was talking about before doesn't log out from those either, they don't really care, because there is no sexting to be exposed from a social network's private messages, or because it is not a "personal" service like an email service.

In Conclusion

I know that you have your own user in a PC, but think about those who don't.

It's all about the content of the application. Do you care if others look at it? What would happen if it is exposed? is it THAT popular so that it would be used by everyone sharing that PC?

Now. Please note this: it is a relatively small group of people. So it would be OK to be able to access to the log out from a menu quickly, say... 2-clicks away (do not uber-hide it), but it should not be super exposed.

share|improve this answer
    
Interesting thought on certain services such as Netflix. Specifically, Netflix is not the best example since other persons have a different taste and rate movies different - so the recommender algorithm doesn't work as well anymore. –  M.Mimpen May 14 at 12:31
    
Netflix has a "change users" button at the top of every page now, allowing you to swap sessions with the other profiles on your account. So if your spouse/sibling/child wants to use Netflix after you, they just need to choose their name from the profiles list with no password prompt. –  CyberSkull May 18 at 23:51

In my current role, the users who I interact with are mostly system administrators. They generally do log out of applications (websites, web apps, desktop apps) when they are done using them. If it's the middle of the day and they're simply stepping away from their workstation for a few minutes, then they will rely on locking their workstation. If they're stepping away for longer than that, whether they logout is correlated to how long they're stepping away. A short lunch is less likely to result in a logout, leaving at the end of the day is definitely a logout.

share|improve this answer

Most users with college level age and experience, do not log out on their personal computer, and often do not log out on public computers.

I participate in many Facebook groups comprised of users with approximately a college level age and experience. Very frequently, a 3rd party will post on their wall something mildly funny and or embarrassing because the 3rd party came across a computer that was logged into the 'victims' Facebook account. This happens so frequently, that it has its own slang term, which is 'hacked'. Side note: this is an unfortunate slang term because it clouds the actually meaning of that word, and makes it seem more harmless.

Most kiosks and workstations at my college, to prevent that security issues with email and department logins, now use a per user login that resets all cache, cookies, and sessions on the computer whenever a user logs out. When using stable, or less public lab computers, many users treat it as an annoyance that the previous user did not log out of their sites, making the next user in line do extra 'work' to complete that step.

I have borrowed many a laptop in college and usually could have complete access to most of the owners sites.

This is a narrow sample size but I think illustrates common behavior. And if security concerns are treated this lightly for 'digital natives' (however much we dislike that term) we can anticipate that things are worse with those of less digital experience.

share|improve this answer

It is correct to say it depends on their risk, and the usability of the site. I was a NetBank early adopter, and have used used it since before it was a browser application. I cannot share any hard facts with you, as I am an ex-CBA employee. In earlier years it was possible to have multiple concurrent logons in multiple tabs on the same browser. Thus it was easier to jump between "identities". Closing this functionality forces family members to logout and login explicitly between sessions (and so you should). Some do and some don't, the ones that do tend not to have their family/housemates steal from them, which frankly happens.

Since this change, a much higher percentage "do", although this is arguably the polite thing to do when relinquishing the keyboard.

(It certainly cuts down the total number of active sessions, which is always desirable from a performance point of view, sadly this is likely the driver for the timeout period, which will be shorter during peak loads).

Some people will consider "what's the worst that could happen" and behave accordingly, other people are exploit fodder.

These matters are over and above the perils of keystroke logging, password (and account) sharing and phishing forms.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.