Logout UI question for the community

[Cantor, Scott]

On 11/30/16, 5:16 PM, "users on behalf of Kozlek, Vincent" <users-bounces at shibboleth.net on behalf of vkozlek at bloomu.edu> wrote:

>    In my opinion if you give the user a list of sites they are not logged out of and they recognize them as sites
> they've recently used, they are far more likely to close the browser in order to get logged out from them.

Right. Which doesn't work, so that makes it all worse, they now incorrectly think they've "fixed" it.

>  If you just give a warning that logout did not work, they probably won't close the browser and will have no way
> to test that logout did not work (if they try a site that did work and see they are not still logged in, they might
> think it did work everywhere, which gives a false sense of security).

If you think closing the browser works, I think you have the false sense of security, perhaps. There is nothing short of total destruction of browser state to accomplish a logout reliably unless you know how the browser is actually configured (and on a shared machine that's not knowable). Not closing it, not rebooting.

-- Scott