Logout UI question for the community
Andrew Morgan
morgan at orst.edu
Wed Nov 30 17:11:27 EST 2016
On Wed, 30 Nov 2016, Cantor, Scott wrote:
> Accessibility issues aside, I'm increasingly wondering why we would
> really *want* people deploying a logout interface that actually reported
> on the success or failure of logout to specific SPs. Even the
> non-technical people who see that immediately ask why that doesn't just
> tell an attacker what services they can get into if they grab somebody's
> open workstation, and that certainly is my take on this.
>
> Is there any good reason for trying to report that to the user, vs. an
> overall "it all worked, or it all didn't work" result?
We don't think that Single Logout will ever work with all of our SPs, so
we don't plan to enable it. :)
Andy
More information about the users
mailing list