[simonw]

"For security reasons, it is advisable for users to log out from a web application once they have completed their tasks."

Isn't that a net reduction in security?

Users are more vulnerable to phishing attacks if you've taught them to constantly login and logout of the applications they use.

Much better to have them sign in infrequently but more securely using 2FA.

[plagiarist]

I think I am far less likely to be successfully phished (compared to earlier internet) now that I have a password manager programmatically checking domains to choose credentials. I wouldn't think everyone is doing that, but maybe iOS and Android have kinda nudged the majority to use password managers?

[simonw]

I agree that password managers are a huge win from a security perspective, but sadly I'm willing to bet they are still used by a tiny minority of people, even now they are built in to common operating systems.

[jddj]

And fewer still are going to avoid copying and pasting the password in from the password manager if the site doesn't match perfectly.