Which Remember-Me option is the best?

Question

Basically, there seem to be three different behaviours of "Remember Me" authentication:

1. Definite: After a successful login, a user doesn't have to provide their credentials during a time span with a definite end (e.g. after 7-14 days). Recurring visits do not extend the period. E.g. Google seems to use this strategy and asks for re-authentication every now and then.

2. Rolling: An extension of the "definite" version; the timespan gets renewed after each automatic login. The user doesn't have to re-enter their details unless they stop visiting for longer time. E.g. SE seems to use this approach; you don't have to re-authenticate if you visit every day, but have to after some weeks.

3. "Infinite": Once logged in, you never have to provide your credentials again for that device unless you're changing the authentication method or you log out. E.g. Facebook uses this approach (to be precise, they set the expiration to 2 years in the future, that's why I put quotes around "Infinite".

Each option has its pros and cons, e.g. 1) might be the best option as far as security is concerned and it also helps remembering your password if you have to provide it regularly. It has the obvious disadvantage, that the remember me expires even if you're visiting every day.

3) sounds like too much of a risk too me. But there seems to be a reason why Facebook doesn't provide an option to auto-logout yet...

The second option seems the best for me as regular users aren't forced to re-enter their password and still have the benefit of expiring if they forget to logout on e.g. a public device (although it could be too late even if expires in some hours).

Let's assume it's for an account that doesn't hold too much personal data and a missed "logout" couldn't do much harm[1]:

What option would you as user prefer and why? Or is there a fourth option you're using (omitting the feature doesn't count)?

[1] Yes I know that it's always bad if a user account gets compromised, but there are less and more valuable user accounts. It's obvious why banking applications don't provide such an option, but there are websites where you rather take the risk than having to login each time.

Answer 1

Even though options 1 and 2 are generally speaking safer, Facebook's approach relies also on a wide range of extra security options the user can manage via your "Security" panel:

If you combine the "infinite" approach with these advanced security options and an https connection I think you have a solution that is safer enough in most (not all) cases.

From a UX point of view the "infinite" approach requires less activity from the user, but the amount of activity required isn't the only parameter we have to consider.

Other aspects you need to consider are, for instance:

• security requirements (e.g., is that a bank? What kind of data are you storing?);
• your users' expertise level;
• the context of use (e.g., they will use your application on a private or shared pc? Will they be in a hurry?)
• how often will they use your application;

It's also important to consider that 40 percent of online shoppers use the “Forgot Password” feature at least once a month. Almost 92% of shoppers abandon a website rather than going through the process of recovering account information, if they’ve forgotten their passwords.

Answer 2

This seems to be more of a security question than a UX question. If I as a user don't care if the account is compromised, I'd certainly prefer that I never have to log in (my yahoo mail account that I only use for fantasy baseball is incredibly annoying in this respect because I have to login weekly if I want to make changes to my lineup). If it's my bank, I want to be forced to login every time.

Assuming there's a one-size-fits-all approach to this, or one better from a UX perspective is probably the wrong idea.