The Shared Library Computer and the Saved Password Prompt
Priya is using a public computer in her college library to check her student webmail. The browser offers to save her password, and she notices the 'Keep me signed in' checkbox is already ticked. She has 20 minutes before her next class, and the queue for computers is long. After finishing, she closes the browser tab but does not use the 'Sign out' button, and she leaves the browser window open on the desktop. The next student, whom she does not know, sits down at the same machine two minutes later. Priya's webmail contains her home address and a scanned copy of her passport.
1. Did Priya take adequate steps to protect her account? Identify the specific actions that created risk.
Read the worked answer
No. Three separate actions combined to create risk:
- 'Keep me signed in' left ticked - this creates a persistent session cookie, so the account stays authenticated even after the tab is closed.
- Saving the password - on a shared machine, this stores credentials that the next user can reuse.
- Not signing out - closing a tab is not the same as ending a session. Only an explicit sign-out invalidates the server-side session.
The correct sequence on a shared device is: untick 'Keep me signed in', decline the save-password prompt, and click 'Sign out' before leaving - then close the browser entirely.
2. The next student now has access to Priya's inbox. Explain why 'just closing the tab' feels safe but is not, and what Priya should do immediately on discovering the problem.
Read the worked answer
Why it feels safe but isn't: closing a tab only removes the visual window; the session cookie persists in the browser profile and the server still considers the session valid until it expires or is explicitly ended. On a shared machine the cookie is still there for the next person.
Immediate actions:
- Sign out of all sessions remotely if the provider offers it, otherwise change the password - which typically invalidates other sessions.
- Change the password from a trusted device, and choose a new one not reused elsewhere.
- Enable two-factor authentication if available.
- Report the incident to the library/IT staff so the machine can be cleared.
- Because the inbox held a passport scan and home address, watch for identity-theft signals and consider reporting it.