Why signing out matters more than you think

Your password manager does its job: it stores strong, unique passwords so you do not reuse the same one everywhere. But one attack path does not use your password at all. It reuses the session you already opened when you signed in — a different problem, with a different fix.

The bypass: a session, not a password

When you sign in, your browser keeps proof that you have already logged in, held in a browser cookie tied to your session. While that session is live, the site does not ask you to sign in again on every page.

In a report dated January 13, 2021, CISA documented a case where attackers successfully signed into one user's account that had multi-factor authentication, or MFA, on. CISA believes the attackers likely used stolen browser cookies to hijack the already-logged-in session — a method CISA called a possible "pass-the-cookie" attack — so the login step, and its MFA check, never ran.

CISA believed this likely happened; it did not state it as certain. This is not a reason to turn MFA off, or to call it useless — CISA still recommends enforcing MFA. The point is narrower: MFA checks the login, and this method reuses a session after login has already happened.

Contrast the briefing "The login prompt you didn't request": there, a prompt arrives when you did not start a login. Here, no prompt arrives at all, because the session was already open.

The password manager gap

A password manager protects your stored passwords — and this attack never touches them. It reuses your already-logged-in session, so unique passwords can't block that path.

That is not a reason to stop using a manager. Reused passwords are still a real risk, and the briefing "One unique password for every door" covers why every account needs its own password. A manager closes the password path. It cannot close the session path, because that path never goes through your passwords in the first place.

Two doors, in short: the manager locks the password door. A stolen session cookie uses the other one, left open because you were already inside.

Sign out, don't just close the tab

One simple habit helps with the session path: when you finish with a sensitive account, sign out instead of just closing the tab.

OWASP's session guidance says logout must invalidate the session on the server side. Signing out tells the site to kill, or invalidate, the session. That also kills a stolen copy of that session, because the copy points back to the same session the site has now ended.

Closing the tab is not the same move. OWASP notes that closing the browser cannot reliably enforce logout. The tab is gone from your screen, but you have not told the site to end the session.

Use this where it counts most: your bank and your email. When you are done, take the few seconds to sign out.

Do this in three steps

1. Sign out; don't just close the tab. Use the account's own sign-out control, so the site invalidates the session server-side — bank and email first.
2. If you suspect malware, switch devices first. Change your important passwords from a clean, trusted device — not the device you suspect.
3. Keep the basics running. Password manager, unique passwords, and MFA stay on; keep antivirus up to date and scan files before opening them.

If you think malware got in

Our guidance at Red Flag Cyber: keep your antivirus software up to date, and scan any file you receive before opening it.

If you believe malware is on your machine, change your important passwords using a clean, trusted device — not the device you suspect. Signing out protects a live session; changing passwords from a clean device deals with passwords that may already have been exposed. For spotting a deceptive lure before you act on it, see the briefing "Spot the phish before you touch the bait".

What signing out can't do

Signing out ends the session you signed out of, on that service. It does not reach into another machine and delete a stolen copy there — it works because the site invalidates the session the copy points back to. Nor does it end separate sessions on your other accounts or services; each has to be signed out on its own.

Signing out does not remove malware already on your machine, and this page makes no claim that it substitutes for antivirus, software updates, or MFA — it does one job: ending a session. If malware may already have taken your passwords, change them from a clean, trusted device.

What still works

None of this is a reason to throw out the basics. Keep using a password manager, keep using unique passwords, and keep MFA on.

Just add the missing piece. A signed-in session ends cleanly only when you sign out. So finish the job: sign out of your bank, sign out of your email, and do not leave closing a tab to do work it cannot reliably do.

Sources: CISA — Analysis Report AR21-013A ↗ · OWASP — Session Management Cheat Sheet ↗