"log off" or close the tab

[janplank]

I was wondering if there is a difference between logging off a internet banking session or if you just close the tab? Is there a security threat where some third party may keep the session "alive" when you closed the tab?

 

[biometrics]

I'd say in theory it's possible to re-establish the connection with the existing cookie. Logging out clears the cookie.

 

[RoganDawes]

I'd say in theory it's possible to re-establish the connection with the existing cookie. Logging out clears the cookie.

Correct. The cookie (assuming a session scoped cookie) remains in your browser as long as the browser itself is running. While the cookie will typically have an inactivity timeout on the server, set to 30 minutes for example, other sites may make the timeout significantly longer.

If someone opens a tab in your browser, and goes back to an authenticated page (i.e. one that would check the session linked to your cookie) before the timeout, they would likely be able to access your authenticated session.

Actually following the "Logout" link should invalidate the session linked to the cookie (i.e. delete all the variables stored in the session), and typically set the cookie to "" at the same time.

 

[janplank]

So it is good practice to always "log off"? What are the chances of someone actually succeeding in doing that???

 

[biometrics]

So it is good practice to always "log off"? What are the chances of someone actually succeeding in doing that???

Little, depending if you practice safe computing.

 

[RoganDawes]

Little, depending if you practice safe computing.

Indeed. The attacker would need to get access to your computer somehow, or else have found a Cross Site Scripting vulnerability in the site you are logged into which would allow them to steal your cookie. Forcibly logging out limits the time that that cookie remains valid for, and terminates its usefulness for an attacker who may have stolen it, whatever the means.

So ultimately, yes. It is best practice to actually "log off", rather than just closing the window. Some sites try to catch the windowClosed event, and execute the logoff for you, but this is browser dependent, IIRC, and doesn't always work.

 

[The_Unbeliever]

Some banking sites logs you off after a few minutes.

I usually closed the tab because it's only myself using that PC, but in future I'll be more careful.

 

[KleinBoontjie]

When I close a tab, while logged into FNB on that tab, I see a little window popping up and show that it's closing a session with FNB. But I still feel safer logging out myself.