Logout UI question for the community

[Kozlek, Vincent]

In my opinion if you give the user a list of sites they are not logged out of and they recognize them as sites they've recently used, they are far more likely to close the browser in order to get logged out from them.  If you just give a warning that logout did not work, they probably won't close the browser and will have no way to test that logout did not work (if they try a site that did work and see they are not still logged in, they might think it did work everywhere, which gives a false sense of security).  Also without the list, some users won't even realize which resources they've accessed actually used SSO since they didn't see the login page and would have no idea which sites would still be logged into, and again probably would not close the browser.  Just my thoughts.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, November 30, 2016 4:15 PM
To: users at shibboleth.net
Subject: Logout UI question for the community

Accessibility issues aside, I'm increasingly wondering why we would really *want* people deploying a logout interface that actually reported on the success or failure of logout to specific SPs. Even the non-technical people who see that immediately ask why that doesn't just tell an attacker what services they can get into if they grab somebody's open workstation, and that certainly is my take on this.

Is there any good reason for trying to report that to the user, vs. an overall "it all worked, or it all didn't work" result?

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net