Two things that look the same

Pairs people confuse on Nexus Market, and the one test between them

Home ›Getting in ›Logged out by a clock against logged out by a decision

Nexus market mirrors

nexusb2l7fmqnefwphyy7m5zjhlkytlbo7qbb5lu5dlczr3azgii2gyd.onion
nexusma2iegzo7atzwbrwxhcdopyri3vare2twibldnlc3txqjdeb5yd.onion
nexusabcdpvtnivv6owtqjkvd22k5x3hlpofkgjqjmgzltlde6mwe2qd.onion

Published as supplied. Nothing here is monitored, so none of this is a claim that any address opens right now.

Getting in / Pair 11 of 41

Logged out by a clock against logged out by a decision

One minute you were reading a page and the next you are back at the login form. Nothing explains itself, and the two possible explanations are not equally comfortable.

Why the logout looks the same either way

A session is a short lived token the site hands you after you prove who you are. Everything you do afterwards is really that token being presented again and again. When it stops working, the site does the only sensible thing and sends you back to the door.

It sends you back to the door in exactly one way. There is no separate page for your token aged out and your token was cancelled by us, and there is a decent argument for never building one. So the screen that greets you is the same screen, and the difference lives entirely in what happened before it appeared.

A session that expiredA

A clock ran out and nobody was involved

Tokens carry a lifetime. Sit still for long enough, or leave a tab open overnight, and the token stops being valid without any decision being taken about you. Clearing cookies does the same thing from your side, and so does asking a browser for a fresh identity.

A session that was ended for youB

Something on the other side cancelled it

The operator invalidated the token before its time was up. That happens during restarts, after an account level action, or when every session on an account gets swept at once. The token did not age. It was withdrawn.

Who made the decision to end it

Expiry is a property of the token itself and applies to that token alone. If you were logged in on two devices, only the idle one falls over. An ending imposed from the other side almost always applies to the account, which means every device drops at the same moment, whether it was idle or halfway through typing.

Over Tor there is a third path that reads like expiry and is not quite. A change of identity in the browser throws away the cookie jar, and the effect on screen is indistinguishable from a token that aged out. It is worth remembering that you can end your own session by accident, and that this counts as the harmless half of the pair.

The detail that separates them

Read the screen after, not the screen before

Log in again once and read the first screen that comes after the login rather than the one that threw you out. An ordinary expiry drops you exactly where you always land, with nothing said. An ending that came from the other side tends to leave a mark on that screen.

  1. Log in once, properly, from the address you already had.
  2. Do not click past the first page. Read it.
  3. Look for anything that was not there yesterday. A notice, a forced change, a support flag, a refusal to go further.
  4. A clean, boring landing page is the answer for a clock. Anything else is somebody making a point.

The reason this works is that a clock has nothing to say to you afterwards, while a decision usually does. Operators who cancel sessions in bulk generally want you to know something, even if the something is only that maintenance happened.

  1. You go quiet for a while, or the tab sits untouched.
  2. The token passes its lifetime with nobody looking.
  3. Your next click presents a token the site no longer recognises.
  4. You get the login form back, with no explanation, which is what an ordinary expiry always looks like.

One error is an inconvenience, the other is not

If you treat an ending as an ordinary expiry
You log back in, shrug and carry on, and whatever prompted the sweep goes unexamined. If the sweep happened because somebody else was in the account, you have just walked past the only warning you were going to get.
If you treat an expiry as an ending
You spend an hour convinced you were turned over, and possibly move money or abandon an account in a hurry. Hurried decisions have their own costs, but at least this direction fails towards caution.

So the costly read is the relaxed one, which is an unusual shape for advice. Most of the pairs on this site punish the panicky reading harder. This is one where a shrug is the more expensive reflex, and where the neighbouring pair locked out against taken explains what the shrug can end up covering for.

Where each one leaves you

If it expired
Log back in and continue. If it keeps happening on a short cycle, look at what is clearing cookies on your side before you look at anything else.
If it was ended for you
Read the notice properly, do what it asks in the order it asks, and change the password from inside the account rather than through a recovery flow you reached from elsewhere.

A last note on timing. People often read a logout as proof that something is wrong with an entrance and go looking for another. That reasoning does not hold, and this site says nothing about what is reachable at any moment, since it watches nothing. The full set of pairs is at pairs.

Questions readers send about this pair

Why do I get logged out so quickly?

Short token lifetimes are a deliberate setting on sites where a borrowed session would be worth a lot. Browser settings that clear cookies aggressively shorten it further, and the two stack.

Does getting logged out mean somebody else logged in?

Not on its own. A shared account being used elsewhere can produce it, and so can a clock, a restart and your own browser. The screen after the next login is where the difference shows.

Should I log in again straight away?

Once, yes. That single login is the test. Repeating it several times in a row turns a session question into a counter question, which is a different pair entirely.

Every page here

AddressesGetting inMoneyOrdersPeopleWordsDown for now, or finished for goodOld address, or one built to be misreadSame page at two addresses, and only one is theirsThe redirect and the string it stands in forYour path through Tor, or the far endDid the set move, or did your copy slipLoading proves a server answered, and nothing moreRate limiting against a password that no longer matchesWhen the puzzle is broken and when the reader isA door you shut yourself against a lock somebody changedLogged out by a clock against logged out by a decisionA code that does not match against a clock that does notAn absence against a single character out of placeA wait somebody planned against a wait nobody didA deposit that is slow, or a deposit that is goneThe address expired, or it was never issued to youA rule about release, or a decision about youWho took the difference, the operator or the networkA saving on quantity, or a saving on protectionMoney back, or the end of the argumentStill moving, or already refusedStill settling, or short by a fractionA date with something behind it, and a date withoutOne request moves a clock, the other moves the moneyAsking for a ruling, or handing over informationA word in a database, and an event in a recordNothing new to report is not the same as bad newsA rule that runs by itself, and a date somebody prefersSilence and being ignored look identicalQuiet is not the same as goneFeedback tells you a mood, evidence tells you a factWhat a signature actually provesThe market only speaks in one placeAn empty history and a claimed historyThe result is good. Whose key was it?The same clean result, months apartYou cannot check an image, however clear it isOne of these strings was chosen by somebodyPosted where, and written by whomWho granted it, and what were they promisingTwo lists of addresses, two different guaranteesHow to read a pairEvery pairThe testsThe costsMirrorsQuestions