Do we really need a "Remember me" option on a Login page?

Question

I'm wondering why do we need to ask user to make a decision, for how long he want to be authenticated? This is done by having "keep me signed in" option login page:

Why can't we simply "predict" how long user wants to be authenticated. For example, 1. User Logged in for first time - 20 min session timeout 2. User's session was expired after 20 min, so he logged in for second time (during next hour after expiration). This means user work with website frequently, so we can extend his next session to 40 min 3. Another use case. We know that user works with our app at least 3 hours a day, so his session expiration time is 3 hours. But now he logging in from unknown/new computer. Let's consider it as a public computer and set session time 20 min (instead of 3 hours).

So, what I'm trying to say is that label "keep me logged in" doesn't describe for how long will user be kept logged in. Also it doesn't describe whether session will be ended when user close the browser window or not.

In addition, website could learn user's habits and learn that some users use web site during their work day from 8am to 5pm. So it may keep them signed in during this timeframe. If user will try to come at 6pm - ask him credentials, but if he comes next day at 8am - don't ask him login/password.

Does it make sense?

Answer 1

The main reason for that, IMO, is if the user is logging in from a location that is not necessarily their home or normal one - public computer, friends house, etc.

By not "remembering me" I signify that I don't want the site to remember my username making it easier for someone to guess my user ID and pass.

Yes, I should log out, but what if I forget? Closing the browser should enable me to get logged out.

Answer 2

There could be a lot of reasons that you would want or not want a "Remember Me" functionality. Typically, it is for convenience. It is so the user either doesn't have to remember or enter either their username and/or password. It usually depends on the application/website itself.

Though I really like the idea of a smart-log in design, it is really hard to predict users patterns. Sometimes they log in to just get an update. Sometimes they log in to enter in data. So, in other words, some are read only work flows while others are read/write work flows. Each might have separate security requirements. When that is the case, you always pick the most secure method. Some scenarios only remember user while others remember both username and password. Obviously one is more secure than the other.

Basically, what I am trying to say is that user predictions can very depending on security requirements, time of the day, date, mood, etc. making it very hard to accurately predict their habits. However, you seem to have identified some basic cases.

All that being said, one really important factor you need to weigh in is the user experience. Sometimes consistency trumps smart/dynamic patterns. To put it simply, if a user has a different experience each time the they log in, it might not be a good user experience. Now, the user is caught trying to figure out when or how long they are logged in to your site.

Maybe you need to ask yourself if the great idea you have, which I think it is, is worth the possible confusion that it might bring to your user. Everyone generally does it a certain way. Though I don't want to snuff out your "outside of the box" thinking, which I love, considering having log in act consistent not only on your site, but others they visit, might be more important.

Have fun deciding. Hope that helps. Have a fantastic day!

Answer 3

I think you need to keep the model as simple as you can with visual feedback if possible.

Your predictive model would be frustrating precisely because it is hidden from the user. Worse still it changes over time.

Perhaps one of the issues here is that the "keep me signed in" option is not actually accurately representing the reason for authentication - it should say "remember me" as many sites do.

Answer 4

As Tha Riddla points out, one of the more important points of this checkbox is to make sure that a username and/or password is not saved on the computer -- such as in the situation where it is a publicly accessible machine without accounts (e.g., library computer).

Such boxes do imply that they will keep you logged in indefinitely, even after closing the browser. Although I have run into many sites where they keep you logged in for a few weeks (or so) and then log you out no matter how often you visit.

Adding a predictive auto-login is an interesting concept, but does have a few downsides I can see. Security is the largest -- on a publicly accessible computer, for example, having a website assume it is me because I've been there every day for the past week is not appropriate. One Offs are a minor annoyance -- because I normally log in between 8am-5pm doesn't mean I can't log in later, and doesn't mean I necessarily want to log in again.

I believe the boxes are the appropriate solution; provided they do what they say. "Keep me logged in" means I don't have log in again... ever (on the given computer)... unless I log out on my own. The trouble comes when a website creates an abstract logic, hidden to the user, as to how long that will be.

Creating such a hidden predictive logic may cause similar confusion and annoyance to users trying to figure out why they sometimes have to log in and why not.

Answer 5

There are a few effects caused by "remember me" or "are you at a public location?" (which has the opposite meaning of "remember me")...

• Should closing browser automatically cause sign out
• Should browser remember user name (can be email address) after log out

There are several reasons that these effects are required...
(Some have already by mentioned in other answers or comments.)

Reasons for sign out:

• Users do not always remember to sign out, especially since on personal computers they do not need to.
• Sign out option is not always in a place that stands out (in fact, some times it is hidden behind the user name).
• Signing out may not be possible (if computer shuts down due to power cut, or OS logs out due to Internet caffee time out and various other reasons)

Reasons for forgetting user name:
(Whether user signs out or it was done automatically.)

• If you are using a public computer, you don't want others to see your user name (or email address) because
  • Some one may try to hack you account
  • Your address could be used for spam
• If you are using a friend's computer, your friend probably doesn't want to have to choose from his/her accounts and yours in order to login (without typing in user name explicitly).