I recently noticed something that I think is easy for technical users to understand, but potentially confusing for ordinary users.
On Windows 11 with Microsoft Edge, I was signed in to ChatGPT. After completely shutting down and restarting Windows, ChatGPT was still fully authenticated when I opened the browser again. No password or MFA was required.
I understand that persistent browser sessions are intentional and that MFA protects the sign-in event rather than every subsequent use of an existing session.
However, I think this creates a significant privacy/UX issue on shared or family computers.
A typical user may reasonably assume:
“I shut down the computer, so my ChatGPT session is gone.”
But it isn’t. The user has to know that they need to go to:
Settings → Security → Active Sessions → Log out
That is not where I would expect a normal “Log out” function to be.
My suggestion
Please add a simple, clearly visible:
Account menu → Log out
And ideally display a short warning when appropriate:
“Restarting or shutting down your computer does not log you out of ChatGPT. If other people use this computer, please log out.”
This would be a very small UI change, but it would make the security model much easier for ordinary users to understand.
I am not suggesting that MFA needs to be triggered after every browser restart. I am suggesting that the normal way to explicitly end a ChatGPT session should be much easier to find.
Sometimes the best security feature is simply a big, obvious Log out button. 