What are the pro's and con's of an extended user session?

Question

When having a portal where due to regulations, the content displayed inside must be accessed through user authentication (username / password). Are there best practices / pros and cons of having extended user sessions after login? Any studies or data that can prove the having longer sessions so when the user returns doesn´t have to login again?

Answer 1

I think it depends mostly on the nature of the system.

The pros of being auto logged out

Paradoxically, in some cases being logged out automatically may improve the general satisfaction of the User from using the system. I can give you two examples.

When I was younger (sad thing is that I have just realised it was 20 years ago) we had an internet cafe at school, armed with a row of Pentium II powered machines. Every student had their ID and a password. Most of them did their private biz on the computers, which, in most cases, was e-mailing and using the antediluvian conversational protoplast of social networks: IRC. Time was limited and you would see a Windows NT login window when it ran out. The accounts were centrally administrated, so the session could be also ended on demand by the administrator. Time-based log outs allowed to avoid getting in possession of a student data. A similar pattern (user is locked, but not logged out automatically) is used in contemporary laptops.

Next, my bank locks the account within several minutes of inactivity, which builds up my trust to it.

My phone locks the screen a few seconds after the screen goes off.

There are two things that are the most prominent value Users get from this behaviour: privacy and confidential data protection.

How extending a session can further increase the value

The phone I use gets locked several seconds after I turn the screen off. In this case, the session is extended beyond its activity. Users notice a screen turning off, which acts as a trigger of turning it back on. The pro here is that they do not need to worry about unlocking the phone again, and the security cost of it is minimal. (On the other hand, the tablet I have locks out when reading articles, and I always need to use a fingerprint scanner to unlock it back – which is so frustrating I once found myself reading articles on the phone).

My bank logs me out automatically after, say, 5 minutes of inactivity. This timer is, of course, reset every time I refresh any screen in the system. But if I do not, two or three minutes before logging out it displays a message saying that If you want to extend the session [click here]. This is very useful especially when looking through some old operation lists, which would take you longer than a session without wanting to leave the screen. Note that security is not compromised.

Google session in my browser does not expire at all, the same about Facebook. However, it is protected by the external security system – laptop, phone or tablet session. So in these cases the security is not breached neither, usually, even though the level of dependency on the security of external system is high.

The auction system I use logs me out, but still preserves some elements of my account, such as welcoming me username and some basic actions. Whenever I need to access something more serious, though, I need to "log deeper in" (does anyone know if this technique has its name?).

Conclusion

I think there is a lot of conceptual space to find a model in which extending the session adds some value. However (depending of course on the type of data it guards access to) you should check if privacy and security is not affected.

So it is worth to extend User session if the satisfaction from this that you bring to the Users does exceed the level of concern from the insecurity it triggers. Sure, this is the rule of a thumb, but it should be considered before anything else, methinks.

Another one would be any negative business effect it can trigger. From business perspective, it may be good to leave the control over it in Users' hands to avoid the headlines saying that "{your system name} has lost my private data. Don't use it if you want to keep your data safe." Again, it is only a thing to consider, but this consideration is also crucial before making any decisions.

Answer 2

Pros of long session expiration

• Easier. Users have a nice experience because they can forget about re-authentication

Cons of long session expiration

• Less secure. Users have a poor experience because their account is compromised.

OWASP is probably the best resource for authentication and session management questions. The UX implication of secure applications (pretty much everything now) are certainly tricky. It's always a matter of compromise.

From OWASP:

The shorter the session interval is, the lesser the time an attacker has to use the valid session ID. The session expiration timeout values must be set accordingly with the purpose and nature of the web application, and balance security and usability, so that the user can comfortably complete the operations within the web application without his session frequently expiring. Both the idle and absolute timeout values are highly dependent on how critical the web application and its data are. Common idle timeouts ranges are 2-5 minutes for high-value applications and 15- 30 minutes for low risk applications.