Page MenuHomePhabricator

Security: no forced logout on multiple logins
Closed, DeclinedPublic

Description

Author: hemanshu_desai

Description:
MediaWiki allows people to login under same username from different computers at
the same time. This means that if I forget to logout from a computer, anyone at
that computer can access Wikipedia and pretend to be me. This is a security hazard.


Version: unspecified
Severity: enhancement

Details

Reference
bz1548

Revisions and Commits

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 21 2014, 8:15 PM
bzimport set Reference to bz1548.
bzimport added a subscriber: Unknown Object (MLST).

richholton wrote:

I would be against this kind of feature, unless it was an individual user option.

I setup my laptop to "remember me between sessions". Basically, I never logout.
I would be very disappointed if this would mean I could not use Wikipedia from
another system.

Also, it would really do nothing to help security. If you forget to logout from
computer A, how will preventing you from logging in from computer B help?
Computer A remains open for anyone to use either way.

hemanshu_desai wrote:

(In reply to comment #1)

I would be against this kind of feature, unless it was an individual user option.

Also, it would really do nothing to help security. If you forget to logout from
computer A, how will preventing you from logging in from computer B help?
Computer A remains open for anyone to use either way.

The idea is not to prevent login from computer B but if same login is from
computer B, the user from computer A should be logged off automatically... again
when you login on computer A, the login at computer B should expire so that
noone else can use it.

Hemanshu

richholton wrote:

The idea is not to prevent login from computer B but if same login is from
computer B, the user from computer A should be logged off automatically... again
when you login on computer A, the login at computer B should expire so that
noone else can use it.

Of course. This makes sense. However, if someone has "remember password across
sessions" checked in preferences, then this would not occur. Am I correct?

I am totally against that feature, I use the same account on multiple
computers and browsers at home.
Users should probably remember to logout when they use their account
on another computer.

Changed severity to enhancement and priority to low, given the opposing comments
above.

epriestley changed the task status from Declined to Resolved by committing Unknown Object (Diffusion Commit).Mar 4 2015, 8:22 AM
epriestley added a commit: Unknown Object (Diffusion Commit).
Aklapper changed the task status from Resolved to Declined.Mar 4 2015, 11:42 AM
Aklapper claimed this task.