It seems that every single banking & financial website that I have used logs me out after a certain period of time.
Are there a legal requirements or technical reasons for financial sites to do this? Or is this just their form of "security" to prevent others from accessing your account should you forget to logoff or secure your computer or device?
This is very poor user experience in my opinion. Google does not log me out after such a short period of time, and I feel that my Google account with 2-Step Verification and a legion of extremely intelligent engineers is far more secure than my banking accounts.
It seems I should be able to choose whether these sites log me out automatically, or if I may stay logged in for a reasonable period of time (30 - 90 days being common for other sites).
Edit:
I believe the selected answer is the most complete answer to the question, but none of the reasons seem to be good reasons for banks to end your session.
There are a couple of levels of risk associated with an attacker gaining access to your banking website session:
- viewing your private (financial) information
- modifying your account (this includes stealing money, locking you out, etc.)
This same situation exists on any website account, but for financial websites, and for most people, #2 is far more severe than for other types of sites.
I think a better solution than logging users out would be to:
- default the session timeout to a short duration
- allow the user to change the session timeout for his/her account
- require re-authentication for actions that modify the account or move money around