Is it safe to allow users multiple login at different browsers & computers?

There is a good reason for preventing concurrent connections - if they are not needed by your users.

A good rule of thumb is to not allow more functionality than that which is needed. If your users are never going to connect more than one simultaneous session, disallowing it would reduce the risk of attack (as an attacker would not be able to conduct their attack while the user was logged in.)

If, however, your users may expect to use multiple sessions, then you'll have to have this functionality.

Really, this question comes down to a functionality issue - google know their users may need to connect from multiple machines/locations/browsers at the same time, so they just notify of other sessions, rather than prohibit them.


I think all the answers given so far are all valid. However I'm not sure I agree completely. Take this site for example. I can have multiple 'sessions' open and logged in on stackexchange.com, does that make security.stackexchange.com less secure? I think that the merits of that are debatable, and there are pro's and cons to the argument. Although I would say that any increase in security risk from allowing it is negligible.

I think that the issue of multiple logins dependant of scenario, is less a question of security and more a question of process. It may make sense to disallow multiple logins due to business process for example licencing. But in other scenarios it may make sense for example increase in usability. Its up to you as the architect to decide if the increase in risk is worth any perceived benefits, or increase in work to disable multiple logins.