NWA-PCUG Newsletter Article, February 2012
The Overlooked Risks of Staying Logged In
By Leo Notenboom
http://www.articlesbyleo.com

Have you ever checked your e-mail on a friend’s computer, public computer, or even display model at the store, only to wonder later if that was a wise move? Is your information safe, or can someone use cookies to retrieve your log in information and access your account?

It depends on what webmail service you’re using. But regardless, you may very well be at risk with any account that requires you to login.

There are three important questions that apply here:
• What does the website store in a cookie?
• How long does the website keep you logged in?
• Is the browser configured to remember passwords?

Each website determines what is and is not saved in cookies. It is possible for a site to use a cookie to save a password; however, this is poor security as anyone with access to the machine could access your account. Most commercial systems don’t use this approach.

A password may be encrypted and only make sense to the service in question, but not decipherable to the user. Or, the cookie may use information to access the account that is not related to your password, but related to data contained in the service’s computer. Either way, it is unlikely a stranger can access your password through cookies saved on the computer.

The greater risk comes from the way most sites allow you to stay logged in for “a while” so that you don’t have to re-enter your information each time you click through different pages on the site or temporarily browse to another site. Some servers, such as banks, keep that length of time short, others keep it fairly long. The result is the same – during that time anyone can walk up to the computer and access your account.

And the solution is very simple: always remember to sign out of your account so no one else can use it.

Finally, make sure you don’t allow the browser to remember your password – typically an option you check when you sign in, or an optional feature of the browser or both. If you allow either, anyone with access to the machine can use a utility program to recover your password.

If you choose to log into your account on a public computer, or even that of a friend, understand you are taking a risk and extra caution is necessary. Make sure to log off completely when you are done, and never allow the browser to save your password.

Click here to return to top



==================================================================