security - When is it right to use "Not ?"

Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out."

When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as someone else? I'd like to believe people log out on shared computers, where the shared computers themselves would usually not store cookies etc.

Answer

I don't think you're approaching this from the right angle. You've seen a feature, and you're searching for a problem to solve with it. That's backwards; add features to solve problems, not the other way around.

A big red flag is that the only company I see doing this is Amazon. Amazon is a prime example of a company not to copy from. See also 10 reasons not to copy from Amazon. Amazon is huge, Amazon has extremely specific sticking points they've identified from years of use. Amazon also has a lot of non-web design reasons people use the site, so you can't assume their UI should be copied at all.

For the record, this is the only place I see such a pattern used:

On dozens of other pages on Amazon I couldn't find this. It is only placed on the personalized recommendations page for me. It is also in a non-prominent place. All it's really doing is giving a convenient "log out" button in case I get a recommendation page and I get my wife/daughters' etc recommendation page.

This is not a UI element that is on every page. It is not in the header. It is hidden on specific, personal pages for a service that assumes your identity without verifying it; Amazon leaves you "soft" logged in to allow you to view your recommendations/track usage when you're not signed in with a password. In this state if you try to buy anything you'll have to be logged in.

This weird sort-of-logged-in state is specific to Amazon's problems; it keeps you logged in sort of by assuming your identity, but requires real authentication to do things. It is not a common state so it causes some unique usability issues that the large majority of apps do not have. This is why there's many more opportunities to log out in Amazon.

However note that even with this weird state, the "if you aren't X, log out" message is still uncommon. There's no need to assume the user has screwed up unless your data shows that a large percentage of your users are logged in as the wrong user at any given time; and if that's the case you've got serious problems well beyond what this feature would solve.

Once again you should be looking for solutions to problems rather than looking for problems for your solutions. If your site doesn't have a relevant problem, don't even begin to consider adding such a "solution".