Soft logout: Validate that the user being logged in is the same that was logged in? (SSO)

[turt2live]

SSO login could result in the logged in user being different from the one that was logged out. Should we prompt to say "hey, you're about to overwrite your session for John Doe with Jane Doe. Are you sure?"

(if yes, what copy should we use?)

[turt2live]

ping @nadonomy

[nadonomy]

Initially I thought this sounded like a great idea, but after chewing the fat on it more I'm not so sure:

• We had a sync this morning and decided to only expose key related things if the user had keys which weren't backed up (server-side key backup disabled, or enabled but with outstanding key uploads)
• If it's the same user, then they'd have had to have manually typed in an entirely different set of credentials (username and/or password), so I think it's expected to discard the previous accounts data
• If it's a different user then I think it doesn't make sense to offer them any recourse over someone else's account

So I'm not sure the warning is actually useful. @lampholder would appreciate a second opinion.

[lampholder]

I've talked myself in circles on this, but I think my final opinion is: login is annoying when anything unexpected happens, esp. .

I tend to just blitz through login as fast as possible, so I will usually fall into any pit a login flow leaves for me. For users like me, therefore I think there's a strong chance that any warning or barrier we put in place to stop people accidentally trampling other sessions is precisely the sort of annoying modal they'll just blindly click through, before (surprisingly) finding themselves still not logged in.

Even if we made a very lovely modal which grabbed just enough attention for people to understand that "oh, I might be about to vape @mike:whatever.tld's session keys, maybe I should reconsider", at that point they are still not logged in to the system they are trying to use, which is annoying, and I would expect the annoyed user to vape mike's session in a heartbeat.

So tl;dr, I reckon the new user just blows away the old user.

[turt2live]

tldr from internal discussions: We'll tweak the design to make this risk less likely, and if the user does end up in a scenario where they are logging in elsewhere then it's their fault because we held their hand as far as we could.