Add checkboxes: "remember me" + "I use a public computer" and make cookie expiration period longer for transition users, survey interviewers and admins when remember me is checked and not a public computer about evolution

[greenscientist]

Don't think it's a good thing to do for admins at least. It's a good security feature to have to login again.

[greenscientist]

Also, what do you propose as a period?

[kaligrafy]

I don't know. What was the policy for this at facebook?

[kaligrafy]

On many bank websites, you can check "remember me for 30 days"

[kaligrafy]

We should also add a button "I use a public computer"

[greenscientist]

Ok, now that you have changed the title, you should probably split it into several issues.

[greenscientist]

At FB, we use 2-fac authentification for anything internal. Some system were at most 12h and defaulting to 3h. Some were longer depending on the criticality.

[greenscientist]

The bank example is bad, as I believe that doing that is a big security flaw. Desjardins is not bad, as it require a new login after less than an hour of inactivity.

[tahini]

So, what about this issue? We have a few new authentication methods: passwordless, anonymous.

Also, as discussed offline, we will aim at some point to have a separate user table for application users, with various levels of permission, and survey users. That will mean 2 separate login pages. Do we hold this issue for now and think again when we have an admin login page?