Tag Info

Hot answers tagged

110

Do note that, even if users "expect" most sites to log them out automatically, in certain circumstances (eg. a shared computer at a friend's home/library/Internet café), they will need an explicit "log out" link to assure them their session is terminated and no one else can access their account. Another valid use case is when users have multiple accounts ...


58

Users do log out conceptually - but not explicitly. Users have become conditioned to sites managing security on their behalf by automatically logging sessions out. They know this because they are continually having to re-login. As this has become expected behaviour, in their mind leaving a site is 'fine' and log-out 'will happen'. But actually this ...


25

The original poster is talking about how many site are hiding the logout link. Facebook makes you open the account menu to see the logout link. My guess is that there's really no need to log out of your account these days. Public computers are not used as much anymore, so there's no need to protect your privacy. Everyone owns their own personal laptop ...


18

Some sites show this in the header to indicate a presumed identity for low risk actions (like add to wishlist), but you can't actually buy anything until you log into the site. So "log out" here would be misleading. Sometimes "Not John? Sign out." is shown as in place of 'sign out' when properly signed in. This is simply a more human way of speaking to ...


17

I have a web site that offers various services for weddings, so my target audience has pretty diversified technical skills. My unequivocal conclusion after 2 years running the site is users do not log out. Or they just leave a page open, and then I am logging them out after 10 idle minutes, or (much worse scenario) they just close the tab/the browser with ...


17

By encouraging users to stay logged in, service providers like Google and Facebook can not only make the login experience less of a hassle, but (perhaps far less innocently) gather browsing data and habits on their users (even when they're not using the service) to enhance advertising intelligence. And that's something that makes me wary.


16

The most expected result would be to duplicate the default redirect that would happen in typical login. For example, if there is a "Login" link in the global nav, the expected result logging in would be to authenticate the user, then land the user back to the page from which the login initiated. If there is a section of the site that is gated by login, and ...


13

Naming it "sign out" is actually missing something important; clicking "not Bob" doesn't just sign you out of Amazon, it presents the page to sign in. So you're not really just signing out, you're signing back in as someone different; because you're not Bob, you're Alice. I think this is an important distinction from the current answers; you're doing more ...


11

You can always come up with a scenario in which that warning would go by unnoticed - think lunch break, or an urgent meeting. So I would at first try to make the existence of those sessions as transparent to my user as possible: reset the session timer as often as possible (e.g. whenever activity is detected) to minimize the occurrence of timeouts if the ...


9

As has been noted above, this depends on the app. But even before the app, this depends on the user. Advanced users adapt their behavior to the specific app, based on a balance between the app's sensitivity and their own paranoia security awareness, like @Goodwine described. Beginners do not log out. I've spoken to a number of not very computer-savvy people ...


9

I believe that a session time out falls under the category of "timed responses". To meet accessibility then, the user should be given the chance to extend, or at the least, be notified it's occurring. Notifying the user about the length of the session is not a requirement, though it should be determined on a "per application basis". For instance, if it's ...


8

Mint.com's is a very nice approach: I would also strongly recommend against alert() - style message boxes to warn the user about their expired session (some websites do this). You can't rescind it, so if the user had left for lunch, they'll come back to the message box, click "OK" to save their session, and then see themselves logged out anyway. The ...


7

It depends on the website / application They do I can tell you that users DO log out, specially when there is a poor management of user accounts on a PC. I have seen people who share their PCs with their family, but do not have multiple users, so they have to keep logging out when they access the same systems (Say... same email provider), and when they ...


7

The first thing to understand is that users don't care about sessions, the session is something you as a developer are forcing onto the user to meet your security/application needs. In an ideal world the session would never expire, like Facebook, Hotmail etc. That said in some situations such as bank sites we still need to expire sessions as we don't want ...


6

Amazon is another example. I didn't notice this trend until you pointed it out. Someone else asked the same question: Why would a web site hide the log out button? Here's a short post on it that pretty much says: By hiding the logout feature, you're more apt to simply close the browser or tab, but effectively remaining logged into a service. This allows ...


5

For the most trouble-free experience, you should have the user log in again right there. Many users have some sort of password manager or use their browser to manage passwords (or scribble it on a sticky note affixed to their monitor… ack!). The only way to assure the user has completed their end of the password change is to log them out and have ...


4

Another reason: for many users, it is more understandable. "Log in" and "Log out" are odd concepts, written in computer-speak, and with terminology left over from timeshare machines. (What are you 'logging', anyway? Are you a log now?) We're so used to them after 40 years, but they still trip up new users. The language "If you're not FOO" is in the user's ...


4

I bet it's because sites are organizing their nav/menus based on each item's frequency of use--and users don't log out very often.


4

In my current role, the users who I interact with are mostly system administrators. They generally do log out of applications (websites, web apps, desktop apps) when they are done using them. If it's the middle of the day and they're simply stepping away from their workstation for a few minutes, then they will rely on locking their workstation. If they're ...


4

I have actually come to appreciate this approach, especially with Amazon, as I commonly use several accounts (employer, personal). I regularly need to answer the question "What account am I signed in as" and if it is the wrong one, I need to switch without much hassle. After all, I usually only care who I'm logged in as if I'm going to make a purchase, and ...


4

Most users with college level age and experience, do not log out on their personal computer, and often do not log out on public computers. I participate in many Facebook groups comprised of users with approximately a college level age and experience. Very frequently, a 3rd party will post on their wall something mildly funny and or embarrassing because the ...


3

You asked for research citations... Wichita State University's Software Usability Research Lab (SURL) published research into Expectations of Users’ Mental Models for E-Commerce Web Layouts and concluded: Comparisons of the responses from users from four geographical areas worldwide show that, in general, participants had similar expectations on the ...


3

Default answer is probably to ignore it. If the user has the correct mental model for not logging in they'll not be confused by not logging out. Best answer is to do some quick research and find out if your users have that mental model. If they don't, find out what they are thinking and design your solution to help move their understanding to match the ...


3

Session expiration time is context dependent, and more Security related than User Experience related. In fact Security and User Experience have divergent goals here. Users dislike to log in again when session expired, but from a security viewpoint short session times protects our users from fraud. In Sweden at least, there is a silent agreement among ...


3

It is correct to say it depends on their risk, and the usability of the site. I was a NetBank early adopter, and have used used it since before it was a browser application. I cannot share any hard facts with you, as I am an ex-CBA employee. In earlier years it was possible to have multiple concurrent logons in multiple tabs on the same browser. Thus it was ...


2

Short answer Don't use the green running man, use the set of icons with text, arrows and lines. Their meaning is more clear, even though the green running man is a common and understood sign Long answer The green exit sign has been used for many years now and is well recognized as intuitive and clear, even on countries that still use text signs ...


2

I think this is more for users that login from a shared computer. The link provides both a visual indicator for the next person that accesses the site from the same computer that someone else logged-in (and didn't logout) while also performing the appropriate steps for that user once they realize this. This is not appropriately a substitute for a logout ...


2

The reason why we placed the logout button in a submenu is because it saves space. Just like on a desktop app (the quit app button is in a drop down menu) we created a "Settings" menu that allowed us to place multiple items into one section freeing up the UI for other pieces of content.


2

You definitely need an icon that different to the standard "X" for closing/exiting the application as you are not actually closing the application down. As you are adding text, the actual icon becomes less important (though a completely inappropriate icon is a bad idea). All it has to be is distinct so that the users can distinguish it from the other icons ...


2

Google and Facebook, like most other websites, don't want you to log out. Nobody there forgot the visibility heuristic. In fact, they put it to very good use, since they know that it will be harder for you to find something you're not seeing. In the case of Google their reluctance to let you log out is much stronger than with most other websites. Other ...



Only top voted, non community-wiki answers of a minimum length are eligible