NO auto logout? How is this safe?

[TAT]

Logging into Malwarebytes requires a verification code, but it appears if you just close the bowser window, you are not logged out even days later. If you go back to the site, click sign in and the dashboard pops up with full access, no user name, password or verification needed. Anyone with access to the computer could access it.

You can even log out and not really be logged out.

When at the Malwarebytes dashboard, if you click manage Identity Theft Protection, it opens in a new tab. If you click Log Out on the identity tab, it looks like you logged out. However, if you close the browser, you can still go back in later with no prompts. 

It appears that to really log out, you have to click sign out on the main dashboard. Doing it on the identity page doesn't really work.

I have been a fan of Malwarebytes since almost its beginning, and was glad when it was announced that Identity protection was going to be offered. However, I don't see how a perpetual login could be considered safe considering the sensitive information. Most really secure sites will auto log you out if you close the browser window, and even log you out if there is no activity on the page for 30 minutes.

Hopefully this will be improved. Since we have two accounts, I tested this with two different accounts and two different PCs. Both worked the same way.

 

[hubingdan]

I agree, not having the ability to logout or sign out, seems to be a security risk.  What gives Malwarebytes?  Is there a logout we can’t se3?

[gatortail]

From the upper right of your my.malwarebytes.com session you have the ability to Sign out:

You can also choose to unclick "Remember me" on the Login screen so that when you kill the browser session you are also no longer logged in.