MIME-Version: 1.0
In-Reply-To: <5185513A.0@kaltenbrunner.cc>
References: <517B7658.9070209@commandprompt.com>
	<517B9613.4090201@kaltenbrunner.cc>
	<20130427140914.GA20361@momjian.us>
	<517BFC61.2070307@commandprompt.com>
	<20130503004045.GC3374@momjian.us>
	<CABUevEzX44DyxsGHnq8L4176FMjBvsjNLL4dXTrOo3ayHBtZ5Q@mail.gmail.com>
	<20130503132345.GG3374@momjian.us> <5185099B.6000604@kaltenbrunner.cc>
	<20130504140518.GA5625@momjian.us> <518548F4.9040109@kaltenbrunner.cc>
	<20130504180854.GB5625@momjian.us> <5185513A.0@kaltenbrunner.cc>
From: Greg Stark <stark@mit.edu>
Date: Sat, 4 May 2013 20:51:23 +0100
Message-ID: 
 <CAM-w4HPCz1zc4LfhD0s5K23t3aJQgkecxN9YBrP4dzVB0oeczA@mail.gmail.com>
Subject: Re: Can we change auto-logout timing on wiki.postgresql.org?
To: Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>
Cc: Bruce Momjian <bruce@momjian.us>, Magnus Hagander <magnus@hagander.net>,
	"Joshua D. Drake" <jd@commandprompt.com>, Paul Waring <paul@xk7.net>,
	PostgreSQL WWW <pgsql-www@postgresql.org>
Content-Type: text/plain; charset=ISO-8859-1
Precedence: bulk
Sender: pgsql-www-owner@postgresql.org

On Sat, May 4, 2013 at 7:19 PM, Stefan Kaltenbrunner
<stefan@kaltenbrunner.cc> wrote:
> hmm pretty sure that browsers are supposed to clear session cookies if
> they are restarted otherwise you will create bad security issues.
> Consider logging in to a some site with personal information, close your
> browser hand over your laptop to somebody in the family for a quick
> browsing session and he will automatically log in to whatever site you
> been at before...

What is this "close your browser"? Are you sure you know when you
close your browser? What about background tasks that might keep the
browser process running even with no windows? And just because you
want Gmail open why does that mean you want to keep credentials for
Facebook and Amazon loaded? Or does it happen when you close the
window? What if there were other windows or if some other site had an
iframe on the web site you're trying to close that you didn't even
know about? When do you "close your browser" on your phone?

Now that the web is more of an application platform each application
needs to think about when it wants the credentials or other local data
it uses to expire and arrange for it to happen as desired. Depending
on a concept like "close the browser" means not really knowing when it
will happen.


-- 
greg


-- 
Sent via pgsql-www mailing list (pgsql-www@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-www