Comments on: Survey results: Websites that keep users logged in

By: Charles Boyung

Charles Boyung — Thu, 07 Jan 2010 21:45:05 +0000

The odd thing about this is that people mentioned browsers remembering their passwords for them, and they also mentioned that security was a reason to not use “Remember Me” functionality on sites. However, these two are actually the exact same thing – the information gets stored on the local computer regardless of where the remember function is implemented – browser or site. Was there any correlation between the two responses – were there people that feared for security that also used browser functionality to remember their passwords?

By: Jamie Carl

Jamie Carl — Mon, 04 Jan 2010 02:31:02 +0000

Hi Nat,

Great write up. It was interesting to see what other’s responses to the questions were.

I just wanted to mention that I think having the ‘remember me’ checked by default would be a bad idea. If it is off by default and you want to be remembered, you only have to remember to check it once. But if it is on by default then you would have to uncheck it every time you logged in.

I also think that password theft was not mentioned because it is usually not the websites themselves that are involved and instead are ‘hackers’ just compromising accounts via dictionary or brute force attacks. If word got out that a website was storing plain text passwords, let alone letting them get out into the wild, that website would quickly become a wasteland. Not something website operators are aiming for in this day and age when everyone is trying to be the next big thing.

/2c

By: Nathanael Boehm

Nathanael Boehm — Fri, 25 Dec 2009 08:44:46 +0000

Interesting point … no one mentioned anything about sites possibly disclosing passwords; perhaps there hasn’t been enough instances of people’s passwords getting out in the open and being used to access other accounts and so on. No doubt people are complacent.

By: Craig Thomler

Craig Thomler — Fri, 25 Dec 2009 02:01:27 +0000

Hi Nat,

Interesting research. I wish I had seen it to participate.

Another factor to consider is the actions the user is taking – as you mentioned briefly regarding LinkedIn.

While I may want a website to remember me for my preferences when I visit, if I am changing my account information – or even deleting my account – I would like a site to reauthenticate me.

I think there is a definite case for action-based authentication prompting rather than simply website-based as the risks of various actions varies. The ultimate would be allowing people to decide when they wish to be prompted to authenticate by action – however I would only expect a few people to customize these settings.

In future research it would also be interesting to look at cross-website authentication, such as via OpenID or the myriad of sites that prompt log-in via Twitter or Facebook (and may post things to your timeline).

I wonder how worried people are about these services gaining acccess to passwords – and potentially keeping or even selling them.
Cheers

Craig