Why is logging in to a website affecting two different computers?

I have two Asus all-in-one desktops running Windows XP Pro SP3.

I set one up perfectly for my needs, so I decided to use Clonezilla to clone it's HDD to the other one.

Everything went well, but now when I log into a site (such as Gmail) on one and refresh the page for that service on the other, the other is logged in with the credentials I used on the first computer. Logging out on one logs out on both.

They both have different IP addresses but are behind the same router and I've changed their hostnames since cloning them.

Why could this be happening?

Update - After some testing, changing the SID had no effect, clearing cookies had no effect, yet restoring IE8 to default settings (including user settings) has resolved the issue temporarily (For three days)

What is causing this?

Tyler Faile

Posted 2011-07-28T15:29:35.737

Reputation: 2 706

Was the MAC address of the NIC cloned as well? – Breakthrough – 2011-07-28T16:38:11.130

No, each MAC is different. – Tyler Faile – 2011-07-28T16:45:02.083

Answers

I don't think it could be related to SSID as your browser won't pass it to a remote server.

I think you didn't clear your cookies after you cloned your hard drive which caused Google to use the same session ID for the two machines.

The HTTP protocol provides no method to identify a machine apart from setting cookies, so most websites store a "session cookie" with a unique ID to identify you. Your log-in state is normally stored on their server and associated to that ID, so they don't have to send you new cookies each time you do something.

billc.cn

Posted 2011-07-28T15:29:35.737

Reputation: 6 821

I am not a cookie expert, but this link seems to support the proposition that cookies do use an SSID. Do they use the same one I was talking about, not sure, but it may be based on that one, so why not change it and rule out something very simple. http://en.wikipedia.org/wiki/HTTP_cookie#Session_cookie

– KCotreau – 2011-07-28T17:11:06.023

How would I force an update for this session cookie? – Tyler Faile – 2011-08-01T16:50:18.047

@Kalamane The easiest way is to clear all your cookies. It's normally an option in the windows that you use to clear your browser history. E.g. in Firefox, use Tools -> Clear Recent History... -> Select "Cookies" alone -> "Clear now" – billc.cn – 2011-08-01T17:22:35.877

Clearing cookies via Internet Options has no effect. – Tyler Faile – 2011-08-01T17:31:24.700

If you're using IE 8 and above, open up Google account settings (https://www.google.com/accounts) and sign-out, then press F12. Use the cache menu in the development tools to remove your cookies. And make sure no cookies are displayed in "View cookie information" page. Then go to Google home page (or any page that does not use https) and clear the cookies again.

– billc.cn – 2011-08-01T21:24:03.753

Resetting IE8 to default settings (clearing all user data in the process) solved this issue. – Tyler Faile – 2011-10-28T17:26:44.950

It is very possibly related to your SSID. The SSID is the real identifier of the computer to other computers. Right now they are still the same computer in a technical sense to other computers.

You should change it on the new computer using this tool from Sysinternals (purchased by Microsoft).

http://technet.microsoft.com/en-us/sysinternals/bb897418 (also read the section: "The SID Duplication Problem")

You can now get it here:

http://www.softpedia.com/progDownload/NewSID-Download-41001.html

KCotreau

Posted 2011-07-28T15:29:35.737

Reputation: 24 985

Perhaps you noticed the message at the top of the page you linked: "Note: NewSID has been retired and is no longer available for download." – William Jackson – 2011-07-28T16:42:26.530

There's a blog post linked at the end of that message that basically explains that SID duplication isn't an issue anymore. – Tyler Faile – 2011-07-28T16:51:58.770

@William Jackson I did not see that as I did not read the page closely. I just knew of the issue, and knew of the tool. I added a new location to get it from. – KCotreau – 2011-07-28T17:07:50.347

@Kalamane I still think that he should change it. It is not hard to do, and it would rule out something simple. I am not one to argue with the VERY esteemed Mark Russinovich, but I would have to wonder why we were doing it all these years, back to Windows 95. – KCotreau – 2011-07-28T17:09:20.940

1Never the less, changing the SSID to something unique is very good advice. – surfasb – 2011-07-28T17:48:33.870

I ran the NewSID program, there was no effect, see my updated question. – Tyler Faile – 2011-08-01T16:49:39.497