Quote Originally Posted by nihil
A large part of the problem seems to be where the service does not recognise the user logging out, so the session remains open until some magic housekeeping process takes place

In my opinion it is a fundamental session management issue, and is not restricted to FaceBook by any means.
Facebook now properly destroys sessions, so that has been taken care of. I went to work and noticed that flickr also suffers from sessions stealing. Their hashing algorithm computes the same session key each time. The result is that if you gain access to a single packet containing a logged in user's session key, you can always log in as that user. My paper was about how Web 2.0 companies do not place emphasis on security and privacy, and choose to focus on incorporating new features. A malicious user can completely wipe out an innocent user's flickr account, or destroy a user's facebook profile or picture database. I really think companies need to do something about this. Sessions need to be made much more secure by storing unique information on the client side as well as the server side.