Comment by xyzzy123

This depends on your "world model", that is, what situations do you anticipate the people using your web site / application are in?

The assumption that basically, device = same person (browser session really) over a long period of time is the right one, 99% of the time.

Sometimes it's appropriate to make much more conservative assumptions. People might be in bad family situations (where not everyone with access to a shared device might be entirely trustworthy) or using a shared computer because they access things from a library, etc.

You can't help much (the computer might as well be compromised) but short session timeouts can make sense.