Learn › Online Safety & Digital Citizenship

Sessions and shared computers: the door nobody teaches children to close

Evidence grade: settled mechanics, practitioner-graded pedagogy. How sessions work isn't contested science; the teaching claim — that sign-out habits are best built on shared classroom machines before high-stakes accounts arrive — is well-grounded practice reasoning, labelled as such.

Password education gets posters; session education gets nothing — yet the most common account compromise in a primary classroom involves no cracking at all. It's a child sitting down at a machine where someone else is still signed in. Everything the curriculum says about secrets is bypassed by a door left standing open.

The concept, child-sized

When you sign in, the computer starts remembering that it's you — a session. Every action while the session lives is done as you: your name on it, your progress spent, your work changed, and (once real accounts arrive) your messages sent. Three properties children need explicitly, because none is visible on screen:

Sessions outlive your attention. Walking away doesn't end one; on many services, neither does closing the window. The screen going dark is not the door closing.
The computer cannot tell substitution. It authenticated once; whoever sits down next is you, as far as every system is concerned. This is why "but I'd never do anything bad on someone's account" misses the point — the danger runs both directions, and intent is invisible.
Sign-out is the only door you close yourself. Timeouts exist as backstops (why ours fires at 45 minutes), but the habit that transfers to every future account is the deliberate one.

Why shared machines are the right teacher

Consumer software optimizes for never signing you out — sessions lasting months are the norm because friction costs engagement. A child who learns computing only on personal devices therefore never meets the concept until the stakes are real (the library computer, the shared family laptop, the first workplace). Classroom machines invert this perfectly: the next user genuinely is someone else, arriving within the hour — consequences small, feedback immediate, repetitions plentiful. It is the ideal training environment for a habit adults demonstrably lack (any librarian can testify to the webmail left open daily).

The rules worth making reflexive, in order:

Done means signed out — before standing up, every time; the habit lives in the standing-up motion, not in remembering.
Found an open door? Close it without walking through it. Someone else's logged-in account is an unlocked diary: sign it out (or tell the teacher) without reading — the kind move and the rehearsal for adult integrity.
One person, one login — "just use mine, it's faster" puts one child's name on another child's actions, in both directions (the borrowed-login scenario).
Public machines get the stricter version: on library/kiosk computers, sign out and close the browser; where offered, use guest/private modes.

What this isn't

Not an argument for paranoia — it's door-closing, the digital sibling of a habit children already have.
Not primarily about malicious classmates — most open-session mishaps are curiosity and confusion; the habit protects against accident as much as intent.
Not solved by timeouts alone — a product's auto-signout is the backstop; a curriculum's job is the deliberate habit, because most services children will meet have no backstop at all.

In the classroom

Make sign-out part of the packing-up ritual — chair in, headphones hung, signed out. Ritualized beats remembered.
Rehearse the found-open-door scenario explicitly — it needs a script ("close it, don't read it, mention it") because the temptation is real and the right move is genuinely non-obvious to a nine-year-old.
Explain the why once, mechanically — "the computer can't tell it isn't you" lands better than "it's the rule."
Model it yourself on the projector machine — children notice which adults leave doors open.

How Wiz Kids applies this

The product practices what this page preaches: a one-click "I'm done — switch wizard!" button makes deliberate sign-out effortless; a 45-minute idle timeout backstops the forgotten door and explains itself in-fiction when it fires; and the Closed Door lesson teaches the whole concept using the mechanic children have already experienced — sessions as doors, the library-computer scenario, the borrowed login, and closing someone else's door without reading their diary. The zero-PII architecture keeps our stakes low; the habits are sized for the accounts that come after us.

References

OWASP — session management guidance (timeout and termination practices for shared environments): the engineering baseline.
UK ICO, Age Appropriate Design Code (2020) — defaults and best-interests framing for children's services.
NIST SP 800-63B — session and reauthentication guidance underpinning the backstop-vs-habit distinction.

© Glu IO Pty. Ltd. — Wiz Kids (wiz.kids). Link freely; republication requires permission — see terms. Found an error in our reading of the research? We correct fast: tell any teacher piloting Wiz Kids.