Should I always log out of websites?

Question

This came up in a conversation between my mom and I and it caused me to reconsider it. I wouldn't be surprised if someone had already asked this here, but I couldn't find any such questions, so here 'tis.

I guess I had mostly dismissed in my mind the idea that you need to log out of websites, citing the fact that the login is just a connection between your browser and that website and doesn't mean it makes it easier for someone to break into your account.

I can understand, say, banking, but for other stuff, such precautions don't seem necessary to me.

But maybe I've got this stuff wrong. What do you all think?

Edit: BTW, I tend to stay logged in; Gmail, forums, Super User, etc. And I don't do banking online, so...

Answer 1

Staying logged in does make it easier for someone to break in to your account, because they could sniff the cookie and then use it to pretend to be logged in themselves. Logging out would theoretically render that cookie useless.

However, if someone is in the position to be sniffing your packets, you're probably already screwed, as they could simply sniff the username and password itself as you log in. Well-designed sites won't have this problem because they'll use a hashing algorithm with a challenge and response, but you'd be surprised how few sites are designed this way.

So basically, yes logging out does technically keep yourself more secure, but it's at such a level where it doesn't really matter anyway.

If it's your own private computer that no one else can use, then just leave yourself logged in.

Answer 2

No, I don't see a reason why. Expecially if half of them are the kind which doesn't bother me (forums, various temporary user logins and such).

I usually check only to logout of my mail account and sites that matter to me.

After all, if you really wish to leave no trace on your computer of your activity, you could always delete all "private data" from your browser (cookies, history ... and the like) or use some program to do so. Newer browsers also have "incognito" (or how do they call it anyways) mode.

Answer 3

If your banking website is bad and susceptible to XSS (Cross Site Scripting) and CSRF (Cross-site request forgery), I would log out as having an active session could mean that visiting the wrong website could empty your account!

That being said, a lot of modern browsers support XSS prevention techniques and if information is being sent such as the above example, it is possible for it to alert you (but a lot of people disable these filters).

Generally speaking, I do not log out of websites as I am the only one who uses my computer... and I hope that the sites I use are not susceptible to the above, however I am sure that best practice would be to log out, and use your browsers features to auto login / save passwords to save time to get back in.

In addition, if you ever visit public places / hotspots, I always go via VPN and/or if not and I really have to log in, I would go as far as changing my passwords when I get home... You just can't trust a computer that isn't yours.