Magic wrote: Surely if someone leaves themselves logged on and there browser window open (an active session) you are going to get the same thing.

I mean when they leave themselves logged on, and then shut down the browser. They come back the next day and are completely logged in.  For that matter, anyone using the machine is logged in as the previous user.

As far as the auto-complete feature in ie, the corporation I work for has every IE browser auto complete feature set to off. You aren't allowed to have it on.  If it's on, your right that's a big security problem also.  I see that as more of a home computer feature, not one to be used in the workplace. But remember, you can turn it off if permanently if you are security conscious.

But my question really is, Borg has this option to not be automatically logged in.  But you have to change the setting everytime you want it off, rather than setting it once.  That's what I'm try to get to.  To just turn it off permanently.

And don't forget, a lot of web developers and programmers sacrifice security for usability and then get bit in the butt big time.  And then they have to answer for it.  Look at microsoft now.

Surely if someone leaves themselves logged on and there browser window open (an active session) you are going to get the same thing.

You are then going to run into IE's auto complete and remember password functions.

There are some things you have to leave to the user (God strike me down) Most sites put this in there Terms and conditions.

Then you have to consider user friendliness !

I would suggest you look at what you actually want to achieve, and then take a good look at your user base. The first is usually limited by the second.

Has anyone turned off the "Automatically log me in when I return to the Forum" permanently?

I know there is the option in the settings to say "no" to auto login and also when you logon(only works for 1 visit though), but I would like to turn off this option completely and was wondering if anyone else had already.  If so, how did you do it.  Am I missing something that is obvious?

The reason I don't want it on is because I want to integrate this forum with a site that has ecommerce and paid classifieds, and I don't want a user to walk away from his desk at work, have someone open up his web wiz forum and have complete access to all his password and profile info.  I would prefer that they login for this info.

Sort of like amazon would be even better.  Amazon will remember you when you visit their site, but if you want to change your personal info, password, credit card info (anything sensitive), they make you do a full login.  For non-sensitive info, they let the cookie do the work.

Thanks,