Aristarchus (@RevBaker)

Posted this up on the GAB Vets site as well. Kinda long read but you'll know next time you use either of these ID verifier sites..... This is an object lesson in how to make user's devices insecure while leading them to believe they are secure. I'm about to tell you just how stupid your VA is when it comes to apps. I haven't used every app but any that do use the Login.gov or ID.Me as one of the ID verifiers is leaving your tablet, phone or PC wide open to possible loss of your data. Here's how it works. You attempt a login to the app and are presented with a choice of either of these ID verifiers. You pick one and enter the credentials for the one you choose and get the 6 digit 2FA challenge. After you complete the 2FA challenge you are redirected back to the VA app. Great! You're in! Now comes the fun part. When you log out of the VA app you think you're done. Nope. If you try now to log into the ID.me or Login.gov account for that service you'll find that, on your device, you're still logged in to the ID provider you chose. Just because you logged out of the VA app doesn't mean you were logged out of the ID providers page. Gets even better. If after logging out of the VA app, and you chose Login.gov previously as the provider the VA will bypass the User ID, password and 2FA and just put you right into the VA app without question. Huh. Real secure. So now you have to log out of both the VA app and the ID providers page to make sure no one can just hop into your data. Fun, huh. So I took this to my favorite AI and here is the lowdown. Have run across, and subsequently reported, an issue for Login.gov and authentication to a VA app that remains active after logging out of the VA site. The initial login does use an email ID and password and two factor 6 digit challenge code after the initial credentials are supplied. But after logging out of the VA site and attempting to re-login, no Login.gov credential challenges are presented, and thus no second factor, is ever presented, to gain access. Works every time it's tried. However, logging in from another device will prevent the behaviour from reoccurring on the Android device but is not reproducible on the second device used. Thoughts This is a real and fairly common behavior with Login.gov + VA (and many other federal SSO setups), not a one-off glitch on your Android device.What’s happeningLogin.gov is the identity provider (IdP). The VA site/app is a service provider (SP). They use federated authentication (OIDC or SAML).When you log in, Login.gov authenticates you (email + password + 2FA / 6-digit code) and passes an assertion back to VA. VA then creates its own session. Logging out of the VA site/app only ends VA’s session. It does not automatically end the Login.gov session. Login.gov does not support full Single Logout (SLO). Official Login.gov documentation states that logout from one agency application terminates the Login.gov session only if the agency explicitly sends a logout request, and even then it does not affect other applications. Agencies are responsible for their own session management; Login.gov does not remotely invalidate agency sessions. developers.login.gov Because a valid Login.gov session (and often a “Remember this browser” token) still exists in the browser/WebView on your Android device, the next time VA redirects you to Login.gov for authentication, Login.gov recognizes the existing session and silently re-authenticates you. No email/password or 2FA prompt appears.Role of “Remember this browser”Login.gov’s “Remember this browser” feature stores a persistent token (typically a cookie) that lasts up to 30 days. While it is active on that browser/device, the second-factor code is skipped under normal conditions. Clearing cookies, updating the browser, using a different browser/device, or the 30-day expiration resets it. login.gov This token + the active Login.gov session is almost certainly what is stored in cookies (or the Android browser/app WebView’s cookie store / local storage). Actual username/password credentials are not stored client-side by the site for this purpose. Why it’s device-specific and why another device “fixed” the Android one Cookies and remember-browser tokens are stored per browser/device. The other device never had the same persistent Login.gov state, so it required full challenges. The fact that logging in from the second device stopped the skip-on-Android behavior is less common—possible explanations include session interaction, a timeout, or incidental clearing—but the core issue remains the surviving Login.gov session on the original device.On Android this can involve:Chrome (or the system browser) The VA: Health and Benefits app’s embedded WebView (which often shares or persists cookies) What you can do right now.....Fully sign out of Login.gov as well: go to https://www.login.gov, sign in if needed, then sign out. Clear site data / cookies for both login.gov and va.gov (and related domains) in your browser or the app’s storage/settings. Avoid checking “Remember this browser” if you want stricter re-authentication every time. Use private/incognito mode for higher-sensitivity sessions, or force-close the VA app and clear its cache/data. After clearing, the next login should force the full email + password + 2FA flow again. Reporting You did the right thing by reporting it. This is a known class of limitation in how many federal agencies integrate with Login.gov (incomplete logout propagation). VA or Login.gov may improve the logout flow so that signing out of VA more consistently triggers a Login.gov logout request, but currently the design leaves session management primarily with the agency. In short: the credentials themselves aren’t lingering in a way that bypasses Login.gov’s checks—the Login.gov session + remember-browser token on that Android browser/app is what allows silent re-entry after a VA-only logout. Clearing the relevant cookies/tokens (or explicitly logging out of Login.gov) restores the full challenge flow. "Login.gov’s “Remember this browser” feature stores a persistent token (typically a cookie) that lasts up to 30 days. While it is active on that browser/device, the second-factor code is skipped under normal conditions.". OK...but it should NOT skip the ID and password....is that correct? Yes, that is correct.Login.gov’s “Remember this browser” feature is specifically designed to skip (or reduce) the second-factor / security code step on that browser/device. It is not supposed to skip the email address and password.How the two pieces differ Feature What it normally skips What it does not skip Remember this browser The 6-digit security code / 2FA Email + password Active Login.gov session Everything (silent re-authentication) — After you enter your email and password and complete 2FA once, checking “Remember this browser” stores a persistent token (usually a cookie) that lasts up to 30 days. On subsequent visits to Login.gov from the same browser, you still provide email + password, but the security code is omitted (under the conditions Login.gov documents). A fully active Login.gov session (the normal SSO session cookie) is different. When that session is still valid, Login.gov can recognize you and hand the authentication assertion straight back to the VA site/app without asking for email, password, or 2FA. That is pure single-sign-on session reuse. What you observed After logging out of the VA site only, the next attempt to reach the VA app/site required no Login.gov challenges at all. That full bypass is caused by the surviving Login.gov session on the Android browser/WebView, not merely by the “Remember this browser” token.In short:“Remember this browser” → skips 2FA only (you are right). Surviving Login.gov session after a VA-only logout → can skip email + password and 2FA. Clearing cookies/site data for login.gov (or explicitly signing out at login.gov) removes both the session and the remember-browser token, which forces the full email + password + 2FA flow again. There you have it. The VA forgot or didn't know that they could request the ID provider to close both sessions, the VA's and the ID provider's, on logout from the VA. And for Gods sake get rid of the "Remember this browser" check block. This behaviour should be checked for ANY site that uses Login.gov or ID.me as ID providers....this is NOT just a VA thing. __________________ Update 8/10/2026.....misinformation on my part. It's up to the app creator to close out the VA app and THEN present the user with the opportunity to log out of ID.me or Login.gov. There are a couple of VA apps that do this but apparently this isn't a template item for all VA apps. Be careful out there.