account ยท post 06 of 7 in this channel
Log out of WeTheNorth market properly, every single time
Closing a tab feels like leaving. It is not leaving. The session usually carries on existing without you.
the three wethenorth market addresses
hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onionhn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onionhn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onionprinted the way they were handed over. no labels, no numbering, nothing here says which one to try first. this feed never opens them, so it has no status light, no percentage and no date of checking to give you.
what a session actually is
When you sign in, the server issues a token and your browser holds it. Every later request carries that token, which is how the market knows the requests are yours.
Closing the tab does not tell the server anything. The token may still be in your browser and the session may still be valid at the other end.
Logging out is the message that says throw that token away. Without it, nothing was said.
why it matters more here
On an ordinary site, a stray session is a small risk with a support desk behind it. Here there is no support desk, and the account it protects has no recovery besides a phrase you may or may not have kept.
The account also contains messages, order history and possibly a balance. A session left open is access to all of it.
The cost of the mistake is high and the cost of avoiding it is one click, which is an unusually good trade.
the shared machine case
This is where it stops being theoretical. Any machine other people use, or administer, or can walk up to, is a machine where an open session is an open account.
Tor Browser being closed helps a great deal, and helps less than actually logging out first, because it depends on the server side forgetting rather than on your side.
Log out, then close the browser. In that order, every time, until it is automatic.
sessions expire, but not helpfully
Most markets time sessions out. You cannot rely on that, because you do not know the timeout and it is measured from something you cannot observe.
And an expiry that arrives an hour after you walked away has already been an hour too late for the risk you were worried about.
the tab habit that helps
One tab makes logging out easy, because there is exactly one thing to close and no chance you left a second one signed in behind a window. That is one of the arguments in one tab at a time.
If a market offers a list of active sessions, look at it occasionally. It is the only view you get of the thing this post is about.
Sessions are invisible by nature, which is why the habit has to be mechanical rather than considered. You will never feel the moment where logging out mattered, and you will never get a notification about the time it did not happen.
Build it as a reflex attached to closing, not as a judgement made each time. Judgement is what fails when you are in a hurry.
replies
a reader askedDoes closing Tor Browser log me out?
the answerIt usually clears your side, which helps. It does not send a log out to the server, so the session may still be valid until it expires on its own.
a reader askedIs staying logged in ever reasonable?
the answerOn a machine only you use, with full disk encryption and nobody else in the room, it is a defensible convenience. On anything else it is a decision people make by accident rather than on purpose.
a reader askedI think I left a session open on another machine. What can I do?
the answerChange your password if you can get in, which usually invalidates other sessions. If the market shows active sessions, end them there. If you cannot get in at all, there is nothing this feed can do for you.
what this post is not Not a description of any particular timeout or session policy. Those vary and this feed does not open the market, so it explains the mechanism rather than the settings.