Alternatively, I keep hoping to see user-controlled federated ID gaining traction - you know, a personal 'wallet' that I maintain myself and store all of my identity in. And when you want to know who I am, you contact my server and it tells if if I approve it. I'd happily take this extra step every time. However, I've realized that this will never happen - too many people don't care, and no major tech companies are willing to push it for fear for backlash.
While I'm wandering further off-subject (but still reasonably tangential): dear people who make marketing email systems, please stop requiring me to log in when I follow your unsubscribe link. One might begin to expect that you add this extra stumbling block to make it harder for me to do what I want - and that's certainly no way to get my business. Every time I get an email from you, I'm reminded that I don't want to be receiving them.
I suppose it's possible that someone has hijacked my email credentials and that they may be fraudulently unsubscribing me. But that's a risk I'm willing to take. You - you hypothetical marketer you - should be too, unless you're a bank. A pissed off customer is not one who will do business with you no matter how many mailings you send.
edit: typos and correctness
Isn't this illegal according to the CAN SPAM act, at least for the types of emails it covers? http://www.business.ftc.gov/documents/bus61-can-spam-act-com...
Yes, it is. The Can-Spam Act requires a simple opt-out procedure. Therefore requiring people to sign up in order to opt out is a violation of the law. Also, if you sign up, you become a customer, and as a customer, the company acquires the right to spam you till the sun goes down (the Can-Spam Act doesn't apply to customers).
But a year later when they suddenly decide to actually do that marketing, it's annoying because I no longer even know what that account is for - never mind how to log in.
Many places are making it truly one-click, but there are a fair number that still require you to authenticate before you can change 'account settings' like notification preferences.
Erm... TL;DR: Because of the existing relationship, I"m not sure that CAN SPAM applies.
(I say this after having only skimmed it - could be wrong.)
You say no, but it reads yes.
Q: "Have you stopped beating your wife?" A: "No. It's time to discuss the appropriateness of wife beating."
Hmm...
Filtering this stuff as spam is a workaround, though, not a solution.
It's one less thing to worry about. Sure, they could have a keylogger, or a dodgy version of their web browser - but it's one less thing to worry about when you're already in a rush.
If you could easily identify that a site you were on had cookies stored, and that one was about you being logged in, and it was plain simple to wipe that cookie then I'm sure you'd be happier about that situation. Couple that with a default to have them disabled - until you explicitly lend your browser a little more trust - to prevent ticking those boxes in a public place. And we might all feel a little better about them.
I guess cookies though are a solution to the leave me logged in checkbox. Another technology could be used. I personally hate them as they currently are.
Even key chain programs are difficult to understand. Safari uses user key-chain, Firefox uses it's own profile to store passwords. No consistency and headaches for users.
Typical users don't have a concept of security, they only want convenience.
If I want to make sure I am not logged in anymore, I log out.
I e-mailed them asking them to make the default unchecked, but I just got a canned response:
"Thank you for the suggestion. We currently do not offer that feature, but we are always open to new feedback. We have added this to our list of feature requests and ideas."
I don't even "Remember Me" on my own system. LastPass takes care of it. First thing I do after installing a browser is to uncheck remember password.
It is an atrocious setting from nineties.
If I forget to log out, my account is open to everyone. If I forget to click "remember me", I have to sign in twice. Making systems that fail safely in case of human error is a good thing.
Although one of my favorite ideas was a system I saw at a hardware store. You could use their terminals to look up products. The terminals had a pressure pad in front of them, and as soon as you stepped off the pad, it ended the session, cleared the cookies, and logged you out.
