We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.
I'm not really sure what the best fix is; there are many possible ones. I've seen total clowns pushing decades-old nonsense be taken seriously by competent businesses simply because they thought "hiring an expert" was enough, like they're a plumber or something.
I think that’s a big difference.
I believe there was an article on HN recently about a startup that used a "lawyer" that wasn't because they didn't check their credentials after getting a great reference. Just because there are consequences doesn't mean it doesn't happen.
Also the computer itself solves this problem for you in many cases, a guest profile typically deletes all browser session info when you log out.
Many sites? Probably.
You're assuming people log out reliably or otherwise behave in the most secure way. They don't.
I also don't see how logging out/killing a session after 15 minutes of inactivity is much of a hardship for the user.
And it's not just extremely annoying, it's also completely unnecessary. Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly.
