Unless the user remembers to close the browser, if they login to CRM on a machine that is not there own, there is no time out.
If the user could be auto disconnected after a period of time, some protection would be offered.
