Habits from signing in to things · habit 19 of 40

Keep me signed in

The box is usually ticked already, and almost nobody unticks it. Signing out has become something people do on shared machines, if then.

What it does everywhere else

On a site you open forty times a day the tick is plainly correct. Re authenticating constantly is a cost with no matching benefit, and services compete on how rarely they ask. Long sessions also reduce how often a password gets typed, which reduces how often it can be watched or captured. For a mail account on a phone in your pocket, staying signed in is the reasonable setting.

What it does on this one

The tick does one specific thing. It writes a credential to disk instead of holding it in memory, so the session survives the window closing, the browser quitting and the machine restarting. Here that means the account stays open on that machine, unattended, for as long as the token lasts.

The habit

You tick the box that keeps you signed in, and afterwards you close the window rather than signing out.

Why it is automatic

Two decades of software gradually stopped asking. Sessions got longer, the tick became the default, and sign out moved from a button in the corner to an item three levels into a menu. The interface itself now treats signing out as unusual, and people follow interfaces.

The cost of the alternative is genuine. Signing out means typing something long next time, and if the password is a generated string it means opening whatever holds it. Multiply that by every visit and the tick is the rational choice on nearly everything a person uses.

There is also no habit of ending a session, because nothing else in modern computing ends. Phones do not get switched off. Browsers restore their tabs. The idea that a visit has a finish marked by an action has quietly left ordinary use, so there is nothing to attach a sign out to.

What it actually does here

Mechanically, the tick converts a session that lived in memory into one that lives in a file. Memory is cleared when the browser exits. A file is not. That is the whole difference, and it is the difference between a session that ends when you stop paying attention and one that does not.

A session that outlives your attention is a session open while you are not there. Anyone who sits at that machine afterwards arrives at an account already signed in and needs no password to look at it. That includes the ordinary and boring cases: somebody borrowing the laptop, somebody fixing it, somebody who lives with you and opened the browser to look something up.

It also survives on disk when nothing else about the visit does. A person who is careful about how they arrive and what they type can undo all of it by leaving behind a token that reopens the account on demand for weeks.

The normal way for a session here to end is that you end it, and then close everything. Closing everything on its own is not the same act. Without the tick it usually amounts to the same thing, but with the tick it does nothing at all, and the two feel identical from the outside, which is why the mistake stays invisible.

What the box actually stores

Without the tick, most sites hand the browser a session cookie: a value held for the life of the browser process and discarded when it exits. With the tick, they hand it a persistent one, with an expiry date some distance in the future, written into the browser profile on disk. Both identify you to the site. Only one survives the machine being turned off and on again.

That distinction is invisible in the interface, which is the problem. Two visits that look identical, ending the same way, leave completely different states depending on a box ticked at the start. Nothing on screen afterwards tells you which state you are in, until you come back and find the site already knows you.

Giving a visit an ending

The useful retraining is not really about the box. It is about restoring the idea that a visit has a finish. Sign out, close the tab, close the browser, in that order, as one sequence performed every time rather than as three separate decisions. A sequence done the same way every time is something you can later be sure you did, which a decision is not.

It also gives you a hook for everything else. The end of a visit is the natural moment to check what got saved, what got downloaded and what got left open, and those habits are gathered under habits from the room you are in and habits learned in the browser.

What to do instead

Everything here is a change to how a visit ends, which is the part of a visit that currently has no shape at all.

Leave the box unticked, including when it arrives already ticked, which it often does.
Sign out with the site control before closing anything. Closing the window is not signing out.
Close the browser entirely rather than just the tab, so anything held in memory goes with it.
Do the same three steps in the same order every time, so that afterwards you know whether you did them.
If the site offers a list of active sessions, look at it occasionally and end anything you do not recognise as yours.

How to notice you did it anyway

The check is direct, because the state is easy to observe. Come back cold and see what the site thinks it knows.

Open the site fresh after restarting the machine. If it greets you as signed in, a persistent session is on disk.
Look for tabs that have been sitting open for days. An open tab is an open session regardless of the box.
Check whether you can recall signing out at the end of your last visit, as opposed to closing something.
Notice whether the machine you used is one other people ever touch, and answer that honestly rather than technically.
Ask when you last ended a visit deliberately. If visits simply stop, that is the habit itself.

What readers ask about this habit

Is staying signed in wrong in general

No. On most services it is the sensible setting and it reduces how often a password gets typed. The reasoning rests on visiting often and on the account not mattering much if somebody else uses the machine.

Does closing the tab end the session

Not when the box was ticked. That writes a credential to disk which survives the tab, the browser and a restart. Without the tick, quitting the browser usually does end it, which is why the two feel the same until they are not.

How often should a session be ended

Once per visit, because that removes the judgement. Deciding case by case means occasionally deciding wrong, and the habits of coming back describe how fast repeated visits stop being deliberate.