Enter your idea

Why have you closed comments on this idea?

https://productideas.xero.com/forums/939198/suggestions/44960581

Agree with all other comments. It's frustrating, annoying, time-wasting (just like adding comments here.....). 🤬

The automatic logout feature is incredibly frustrating and time wasting. As we are adults, and not little children, we should be able to decide for ourselves, based on our circumstances, when, or how frequently, the system should log out.

I don't know about anyone else, but none of our team ever receives the inactivity prompt you mention. We just get logged out. I don't appreciate the team's time wasted having to log in 8 times a day. As mentioned by many before me, this one approach fits all to cyber security is a lazy approach and infuriates many. Xero can and should do better here.

I propose the following:

1. Create a setting in the account settings to modify the time for time-outs.
1. (a) Time can be 10 minutes, 15 minutes, 30 minutes, 60 minutes, 180 minutes.
2. When modifying the time, make the user sign in again and use their MFA to ensure it is the authorized person that is changing it.
2. (a) Since Xero accounts require MFA, this should not be a difficult thing to enforce each time the setting is modified.
3. When implementing this feature, make the default setting 60 minutes. That way you're complying with the industry standard for cybersecurity best practices.

Agree that the 'one timeout does not fit all'. Please give your customers a choice to make their own informed decision on this one.

So the idea has been closed and users can't vote? High handed or what!

This is an unnecessary "feature" that probably has more to do with limitations of Xero infrastructure than it does with anything else.

We have logins/fingerprint sensors/codes/ on our machines that keep others from accessing. We do not need Xero telling us that we can't leave a web page for 10 minutes without enforced timeouts.

Xero has important info - so do loads of other programs/apps. Imagine if we had to log back in every time we left a spreadsheet, word document, a web order, etc, etc. It would be an absolute nightmare.

Xero's CHOICE to make it more difficult for us to use the program is NOT APPRECIATED!

Wow, this is a super annoying (feature) of the system. I totally get it for organisations working in offices where data privacy is critical. But I'm a sole trader and work alone. I would prefer a timeout of 12 hours.

Has this issue really been going on since 2013 ??
Xero Team (Admin, Xero) shared this idea
· Sep 6, 2013 · Report…

Surely Xero can come up with a better system. I believe user ability to set logout time should be available.

Rubbish - its completely unnecessary - no other software for accounting has this !!

1

Need to stop this auto log out after 60 minutes - you keep saying it's for security but if that is the case we can log out ourselves - no other software has this - Its nothing more than a waste of time - we do not sit at our desks every minute of every day and with the app you have to get codes for as well its nothing short of ridicules. If it continues, we will have to change software as all our staff are complaining.

Need to stop this auto log out after 60 minutes - you keep saying it's for security but if that is the case we can log out ourselves - no other software has this - Its nothing more than a waste of time - we do not sit at our desks every minute of every day and with the app you have to get codes for as well its nothing short of ridicules. If it continues, we will have to change software as all our staff are complaining.

I'm sorry, but this is an ill-considered position for Xero to take.

Firstly, there isn't (or certainly shouldn't be) any extra risk to the integrity of the Xero application itself. That sounds like an argument made to suggest that my preferences put other users at risk, which really isn't the case. (If being logged in really puts the Xero application at risk, that means that anyone logged in can do harm to the application. I really hope that isn't the case!)

The main point, though, is that there is always a trade-off between security and efficiency. But where the optimum trade-off lies depends on individual circumstances. No-one's suggesting a longer idle time across the board. Every user's maximum idle time should be up to the admin of the client organisation to decide, taking into account how accessible the computers are, etc. Some admins might think that forcing a log-off after 20 minutes of idle time is required in their situation. A one-man business working from home might prefer to stay logged in for the whole day.

Whose interests is Xero acting in, in deciding for me, how long it's safe to be logged in and idle? Not mine! Make it an admin-only user option with a warning. But don't take decisions about MY business, on my behalf, thank you.

Love this truthful comment so had to repost. XERO What are you doing!! Tsk tsk! Have you forgotten who made you??

So once again Xero is not listening - they are right and we are wrong and to prove it they will increase their prices

Seriously! What was the point of the survey? You disrupted everyone's workflow to force them to give you their opinion. Then in true Xero style, you didn't listen to what they had to say and did what you had already decided anyway. Another great way to alienate your customer base. 5 stars for making us feel unheard and unworthy of making our own decisions AGAIN!

I'm in IT Security, and this isn't the approach you take (We know better than you) unless you want to alienate your user base and cause general discontent.

Allow the organization to adjust this between any defined windows of say, 1-240 minutes. This is an risk management decision at an organizational level. Set the default to 60 minutes but allow each ORG to define their own idle timeout policy.

OR, "lock" the session but don't log it out. I'm sure you're all capable of figuring that out.

Xero's refusal to listen to your customer's is jarring on this, and the SSO enablement both. For an otherwise great product, it's really frustrating.

Session hijacking is a real and serious problem, however there are other ways of dealing with it besides such a strict session timeout. And of course, this doesn't prevent a session hijacking attempt, it just means the window of attack has to be within an hour of signing into Xero. It's extra inconvenient for people who need to sign in sporadically during the day, and the short session is only marginally more secure, it's not like it guarantees security. It should be part of a holistic security and threat detection system. For example, why can't I see active sessions in my account? If my session has been hijacked, where's the list of sessions currently active on my login?

So once again Xero is not listening - they are right and we are wrong and to prove it they will increase their prices

No