Got logged into 3 random account everytime i open the site

What URL is your bookmark linked to? And when this does happen are you logged in as a different account each time, or is it the same one?

Just logging in over the same VPN or with the same IP Address wouldn't actually cause this issue. It's all based on what cookie (and session ID) you have stored on your computer. All of Roll20 is secured with SSL, so in theory even if you guys were "crossing paths" on the same VPN none of the communications that you  send to our server (and we send back to you) should be able to be viewed by anyone other than the originating browser. What I think is likely happening is there is some sort of caching proxy that is in place between your computer and our server. What that means is when you request a page (e.g. the home page) instead of fetching the page from our server every time, the proxy is instead returning a cached ("old") version. If the proxy is misconfigured, it's possible that it is returning pages from other people's sessions (so for example at the top of the page it would say "Yashan" instead of "small Boss"). However, if that's the case you wouldn't actually be logged in on our site as the other person, so if you tried to do something you shouldn't be able to, such as access one of their games, it wouldn't actually work. The next time it happens, can you try going into an actual game on the account that you seem to be logged in as that isn't your own and see if it actually lets you log into the game?

So the weird thing is that right now we show that you and small Boss connect from the same IP Address? I can't imagine the chances of that are very high. It's interesting that you are having the same problem even though you don't use a VPN. I'll do some Googling and see if I can find any other reports of this sort of thing happening.

We've gotten 5 or 6 reports so far of this happening. So far all we know is they are all from Egypt. There are no other reports of it happening in any other regions. My best guess is that for some reason either the ISP you are all sharing or the Egyptian government as a whole has set up some weird proxy between your computer and our site. This proxy appears to be misconfigured and is sending the Set-Cookie: header to the wrong people.  I'm surprised that we're the only site it's happening on, though. As I said, we're doing pretty standard stuff with our login system, nothing out of the ordinary. The way that these systems work is whenever you login, we send you a Cookie which identifies who you are on the site. In theory SSL should keep that Cookie from being seen by anyone else but there are some governments/ISPs that have started man-in-the-middle attacking SSL connections to break that security. I'm not really sure what else we can do on our end to help. As I said I'm looking into it to see if there is anything I can find out. But all of the info I am finding says that we are doing what we need to do on our end. Also, to point out, you sharing an IP Address is not the problem.However, what I'm saying is that in theory unless you literally live in the same building with each other, the changes that your IP Address would match should be next to none. Which (again) would indicate that there is some sort of proxy in place that is routing your traffic through the same IP before it comes to us.

I just made some changes on our end. In theory they shouldn't matter if the proxy was well-behaved, but if it's not following the spec like it should be it might help. It may take a little while for the changes to take effect for you guys, though...let me know if you're still seeing this issue in 24 hours and if so I can try something else.

So as of right this second, both of you (small Boss and HaLwAsA) are connecting from the same IP. Why would that be happening? (Again, having the same IP does not cuase the login system not to work, but it's a big red flag that shouldn't really be happening).

Okay, well, let's try a couple more things. Can you get me a screenshot of what your Network Connection tab shows when you are seeing someone else's account? So basically go to <a href="https://roll20.net" rel="nofollow">https://roll20.net</a> , and then open your Network Console (Ctrl + Shift + J in Chrome, then click on "Network"), then reload the page with it open. You should see a bunch of stuff show up in teh window, but at the top should be 'roll20.net'. If you could click on that so it shows the details (like the headers) and send me a screenshot of it, that would be great. Here's an example of me doing it: The other thing, if you click on the little green lock icon in the browser window (I have an arrow pointing to it below, top-left corner), then click on "View Certificate" on the right side. If you could send me a screenshot of what the info in the box I have highlighted says for you, that would help too. You can send me that info at <a href="mailto:riley@roll20.net" rel="nofollow">riley@roll20.net</a> if you want since it's personal stuff, and I'll take a look. Just want to see if I notice anything weird going on. Thanks!&nbsp;

I'm working with HaLwAsA to get the problem resolved for them. In the meanwhile, if you haven't already the rest of you can send me that stuff and I think we can get it taken care of. Thanks!

So far so good with HaLwAsA. Let me know if anyone else is still having issues.