Do users log-out?

Question

We have grown noticeably accustomed to logging in or signing in to systems and websites in many places.

I know that many sites such as my bank (NetBank) logs me out as soon as I exit the page¹; but many and more don't.

In an article which I recently read, the writer states:

This type of authentication maps very naturally to a web site, because users are used to “logging in” when they start working with a particular site and “logging out” when they are done.

But is this actually the case? Do users explicitly log out of sites when they are done?

I know I certainly don't; and I'm a Web/Software Developer²

---

NOTES:

• Please provide evidence and/or research as part of your answers (if possible).
• I ask this as I would like to know whether or not to base my UX design on users' behaviour to ensure their safety.
• Question is not relevant to non-safety-concerned sites where it doesn't matter if you stay logged in (StackExchange on home computer etc.).
• According to this answer on a similar question; many sites don't even prominently display the log-out/sign-out button.
• Another related question: How should a user exit an intranet web app with automatic login?

^{1. I think that it doesn't kill the session when I leave, but kills any sessions if they exist when I return, making it seem like it kills on page close. Either way, doesn't matter for our discussion.}

^{2. Unless I'm at a public or work computer.}

Answer 1

Users do log out conceptually - but not explicitly.

Users have become conditioned to sites managing security on their behalf by automatically logging sessions out. They know this because they are continually having to re-login. As this has become expected behaviour, in their mind leaving a site is 'fine' and log-out 'will happen'.

But actually this "Log-In" / "Log-Out " dichotomy is artificial. Amazon manages this very well in three levels:

• Unknown user

• Known user => access non-sensitive actions

• Known user recently re-authenticated => access sensitive actions

Answer 2

Do note that, even if users "expect" most sites to log them out automatically, in certain circumstances (eg. a shared computer at a friend's home/library/Internet café), they will need an explicit "log out" link to assure them their session is terminated and no one else can access their account.

Another valid use case is when users have multiple accounts (husband and wife) and want to switch accounts.

So please always provide an explicit option to "log out".

Answer 3

I have a web site that offers various services for weddings, so my target audience has pretty diversified technical skills. My unequivocal conclusion after 2 years running the site is users do not log out.

Or they just leave a page open, and then I am logging them out after 10 idle minutes, or (much worse scenario) they just close the tab/the browser with the close button (x).

And then I have to track these "hung" sessions for some time, to make sure that the user is really gone. What a headache! Sometimes I think that the user is gone , but s/he actually is there, just does nothing. Sometimes a user is gone, but I am still thinking that s/he is there, so I prevent opening this account on another computer. An absolute nightmare, but I believe it is a sad reality for any non professional audience - closing by x, no log outs

As I base my conclusion on thousands' users experience, I think this generalization is well substantiated.

Answer 4

As has been noted above, this depends on the app. But even before the app, this depends on the user. Advanced users adapt their behavior to the specific app, based on a balance between the app's sensitivity and their own paranoia security awareness, like @Goodwine described.

Beginners do not log out. I've spoken to a number of not very computer-savvy people in theirs sixties who were at a complete loss when they tried logging into their email account from somebody else's computer and it had asked them for their password. As they usually put it, "this computer doesn't have my email". They had forgotten that they even had a password, and the concept of logging in was foreign to them. This because they never log out at home, they know that they have to click a bookmark in their browser ("in The Internet") and their email is there waiting for them. This goes for often-used apps, like email.

In more rarely-used apps, like online banking, they are well aware of the concept of logging in, because the app takes care to log them out after a period of inactivity or when they close their browser. But they still don't log out - they're both uneducated about information security, and they aren't aware that there's a "session" going on. When they're done they just close the browser, because they're done - they've completed all the actions they needed to do. Logging out is a "meaningless" purely technical action, it's not part of their "to-do list".

Answer 5

It depends on the website / application

They do

I can tell you that users DO log out, specially when there is a poor management of user accounts on a PC. I have seen people who share their PCs with their family, but do not have multiple users, so they have to keep logging out when they access the same systems (Say... same email provider), and when they want to protect their privacy (Say... a social network).

Also, I used to work (a long time ago) in a company that outsourced Customer Service, and we shared PCs, with the same user, it was an anarchy! We had to keep logging out every time we left the PC alone, because the next user could have a malicious intent.

They Don't

There are certain services that I don't really care if someone gained access to because "I left my account logged in", such as Netflix, or YouTube. And the same family that I was talking about before doesn't log out from those either, they don't really care, because there is no sexting to be exposed from a social network's private messages, or because it is not a "personal" service like an email service.

In Conclusion

I know that you have your own user in a PC, but think about those who don't.

It's all about the content of the application. Do you care if others look at it? What would happen if it is exposed? is it THAT popular so that it would be used by everyone sharing that PC?

Now. Please note this: it is a relatively small group of people. So it would be OK to be able to access to the log out from a menu quickly, say... 2-clicks away (do not uber-hide it), but it should not be super exposed.

Answer 6

In my current role, the users who I interact with are mostly system administrators. They generally do log out of applications (websites, web apps, desktop apps) when they are done using them. If it's the middle of the day and they're simply stepping away from their workstation for a few minutes, then they will rely on locking their workstation. If they're stepping away for longer than that, whether they logout is correlated to how long they're stepping away. A short lunch is less likely to result in a logout, leaving at the end of the day is definitely a logout.

Answer 7

Most users with college level age and experience, do not log out on their personal computer, and often do not log out on public computers.

I participate in many Facebook groups comprised of users with approximately a college level age and experience. Very frequently, a 3rd party will post on their wall something mildly funny and or embarrassing because the 3rd party came across a computer that was logged into the 'victims' Facebook account. This happens so frequently, that it has its own slang term, which is 'hacked'. Side note: this is an unfortunate slang term because it clouds the actually meaning of that word, and makes it seem more harmless.

Most kiosks and workstations at my college, to prevent that security issues with email and department logins, now use a per user login that resets all cache, cookies, and sessions on the computer whenever a user logs out. When using stable, or less public lab computers, many users treat it as an annoyance that the previous user did not log out of their sites, making the next user in line do extra 'work' to complete that step.

I have borrowed many a laptop in college and usually could have complete access to most of the owners sites.

This is a narrow sample size but I think illustrates common behavior. And if security concerns are treated this lightly for 'digital natives' (however much we dislike that term) we can anticipate that things are worse with those of less digital experience.

Answer 8

It is correct to say it depends on their risk, and the usability of the site. I was a NetBank early adopter, and have used used it since before it was a browser application. I cannot share any hard facts with you, as I am an ex-CBA employee. In earlier years it was possible to have multiple concurrent logons in multiple tabs on the same browser. Thus it was easier to jump between "identities". Closing this functionality forces family members to logout and login explicitly between sessions (and so you should). Some do and some don't, the ones that do tend not to have their family/housemates steal from them, which frankly happens.

Since this change, a much higher percentage "do", although this is arguably the polite thing to do when relinquishing the keyboard.

(It certainly cuts down the total number of active sessions, which is always desirable from a performance point of view, sadly this is likely the driver for the timeout period, which will be shorter during peak loads).

Some people will consider "what's the worst that could happen" and behave accordingly, other people are exploit fodder.

These matters are over and above the perils of keystroke logging, password (and account) sharing and phishing forms.