"Remember Me" checkbox in new login should remember preferences

[Pabbles]

That's it. It'd be more fitting as a bug report than as a suggestion, but it's been there since the introduction of the new reactlogin, and the -noreactlogin option has finally been removed so I can't avoid it anymore.

Please remember when we unchecked "Remember me".

[Seneca]

+1

[RiO]

I'd take it one step further; it should not remember preference at all.
It should always start in the disabled state and require a user to explicitly opt in.

After all the screen that contains it is only shown under two very specific conditions:

1. each time Steam is started, as long as the user's choice was to not have Steam remember their login session -- i.e. when the user wants that checkbox to be and remain disabled.
   
2. when the logged in user explicitly logs out of their account, rather than just closing Steam. I.e. when they want to end their login session.

In the second case, one of the number one causes would be: "oops, forgot to disable the checkbox! Better log out and be sure to uncheck it this time..."

So the fact that Valve implemented this as standard-enabled flies directly in the face of all forms of logic and reason.

But it gets worse when you extend this to consider multi-user systems and browser-based logins. Afaik the checkbox is default enabled there as well. So anyone logging in on e.g. their workplace system to quickly purchase something; to reply to a forum thread on these community forums; etc. etc. over their lunch break, rather than doing so via their phone can potentially leave an active session on such a shared system without scarcely realizing it.

How many people remember to actually log out? How many just rely on closing their browser ending any active sessions? It's a rather unfortunate additional vector of getting your account compromised.

[Seneca]

Originally posted by RiO:

I'd take it one step further; it should not remember preference at all.
It should always start in the disabled state and require a user to explicitly opt in.

After all the screen that contains it is only shown under two very specific conditions:

1. each time Steam is started, as long as the user's choice was to not have Steam remember their login session -- i.e. when the user wants that checkbox to be and remain disabled.
   
2. when the logged in user explicitly logs out of their account, rather than just closing Steam. I.e. when they want to end their login session.

In the second case, one of the number one causes would be: "oops, forgot to disable the checkbox! Better log out and be sure to uncheck it this time..."

So the fact that Valve implemented this as standard-enabled flies directly in the face of all forms of logic and reason.

But it gets worse when you extend this to consider multi-user systems and browser-based logins. Afaik the checkbox is default enabled there as well. So anyone logging in on e.g. their workplace system to quickly purchase something; to reply to a forum thread on these community forums; etc. etc. over their lunch break, rather than doing so via their phone can potentially leave an active session on such a shared system without scarcely realizing it.

How many people remember to actually log out? How many just rely on closing their browser ending any active sessions? It's a rather unfortunate additional vector of getting your account compromised.

^^THIS

[egon]

+1

[Pabbles]

Well, I noticed that the checkbox now remembers its unchecked state. Good on you, Steam, I am left with only aesthetic reasons for wanting to go back, and that is manageable.

[AvidLuna]

Originally posted by RiO:

I'd take it one step further; it should not remember preference at all.
It should always start in the disabled state and require a user to explicitly opt in.

After all the screen that contains it is only shown under two very specific conditions:

1. each time Steam is started, as long as the user's choice was to not have Steam remember their login session -- i.e. when the user wants that checkbox to be and remain disabled.
   
2. when the logged in user explicitly logs out of their account, rather than just closing Steam. I.e. when they want to end their login session.

In the second case, one of the number one causes would be: "oops, forgot to disable the checkbox! Better log out and be sure to uncheck it this time..."

So the fact that Valve implemented this as standard-enabled flies directly in the face of all forms of logic and reason.

But it gets worse when you extend this to consider multi-user systems and browser-based logins. Afaik the checkbox is default enabled there as well. So anyone logging in on e.g. their workplace system to quickly purchase something; to reply to a forum thread on these community forums; etc. etc. over their lunch break, rather than doing so via their phone can potentially leave an active session on such a shared system without scarcely realizing it.

How many people remember to actually log out? How many just rely on closing their browser ending any active sessions? It's a rather unfortunate additional vector of getting your account compromised.

I pretty much made the same suggestion directly to Steam, they told me to post here... So I also made a post here earlier. That seems to have disappeared in the myriad of new threads being made so I guess I'll bump and +1 this.