Logout UI question for the community

[Prog]

I second Vincent Kozlak and Aaron Howell in that showing a list of SPs 
reveals important information to the user to distinguish between sites 
they are logged out or not and having a configuration option that 
defaults to 'do not list SPs' which probably would fit anyones needs.

We run an SSO-environment where SPs must implement Logout (contractually 
required). We would prefer to have users blaming a distinct application 
does not logout them correctly rather than having them blame the whole 
environment. Besides that I am not sure if a list of SPs would even be 
required by our data protection department.

Regards,

Michael


Am 30.11.2016 um 22:14 schrieb Cantor, Scott:
> Accessibility issues aside, I'm increasingly wondering why we would really *want* people deploying a logout interface that actually reported on the success or failure of logout to specific SPs. Even the non-technical people who see that immediately ask why that doesn't just tell an attacker what services they can get into if they grab somebody's open workstation, and that certainly is my take on this.
>
> Is there any good reason for trying to report that to the user, vs. an overall "it all worked, or it all didn't work" result?
>
> -- Scott
>
>