A session you think is still yours

Minutes to undo

A session exists on a server. It is not a feeling you have about a browser. It stays open until something closes it, so if you left one running on a shared machine, it is still open for now.

Osiris market addresses

osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion

osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion

osirisydmlx47esm6ylhzhtnjrucgnymi7beqoyzze5jn3opbr3zy4id.onion

Printed as supplied, in no order. Nothing here is watched or timed, so an address that loads is not proof of anything. More about the set

1.A session is an object, not a mood

When you sign in, the site notes that this browser is you and hands it a token. After that the site is not checking your password. It is checking the token. Most of the trouble here comes from the gap between what a session is and what people picture.

The useful move is to stop thinking about tabs and start thinking about a list of open doors, held by the site, one row per door.

Window opens: At sign-in, when the token is issued.
Window closes: When that session is signed out or the site expires it.
What closes it: A deliberate sign-out, or the site's own rule, or nothing at all.
Still possible after: Repairing whatever the session could reach.

2.What you actually ended

What you did	What that ended
Closed the tab	The view. The row on the server is untouched.
Closed the whole browser	Depends on the settings. The token often survives a restart.
Signed in from another device	Usually nothing. Most systems allow several live sessions.
Signed out properly	That one session. The others stay open until each is signed out.
Changed the password	Sometimes every session, sometimes none. The site decides, not you.

3.Cut it off, in this order

Sign in from a machine you do control.
Use the sign-out-everywhere control if the account has one. If it does not, change the password and then sign out.
Sign back in once and check the contact and withdrawal details are the ones you expect.
Then go and close the loose machine if you can reach it.

That order shuts the door before you spend twenty minutes walking across an office. If the password itself was taken rather than just left signed in, start instead with the page on a password typed into a copy.

Read nextA browser left open on a shared machineThe physical half of the same problem.

4.What the gap depends on

On whether anyone touches that machine, and on whether the site expires quiet sessions. Neither is under your hand. A session on a laptop nobody else uses might sit harmlessly for a week. The same session on a shared desk lasts until the next person sits down.

That is why the label here is until it is closed rather than a number of minutes. The boundary is somebody touching a keyboard.

ImportantSigning in somewhere new is not a kick. A great many systems are happy to run several sessions for the same account in parallel, and will not tell you the others exist.

5.The beliefs that get people here

The first is that closing the tab ends the session. It ends the picture of the session. The second is that logging in elsewhere kicks everyone else out, which is true on a few systems and quietly false on most.

A third hides behind them: that a session idle for hours must have lapsed by itself. Sometimes. The word sometimes is not a plan, and an account nobody watches becomes a slower problem of its own.

Also usefulAn account nobody logs intoWhat happens to the doors you stop checking.

6.Once every session is shut

Work out what a stranger in that session could have read rather than what they could have done. Messages hold more than balances do. If a delivery address or a key was visible, that part does not close when the session does, and what is still possible afterwards is the page to read next.

The tab is a window onto the door, not the door.

Shutting a tab removes your view of an open session and nothing else. The site keeps its row. Anyone who reopens the browser on that machine walks back in without typing anything.

Questions people send in

Does clearing cookies end it?

It ends it for that browser, which is enough if the loose session is in front of you. It does nothing to a session running on another machine.

Can I see the open sessions?

Some accounts list them and some do not. If yours does not, changing the password and signing out is the closest thing you have to a list.

How is this different from walking away from a screen?

Walking away is physical and sits on the page about a browser left open. This one is about the token, which travels further than the room does.