My employer recently invited me to join their new Stack Overflow for Teams instance. I was already signed into Stack Exchange with my personal account and I connected to my new work team via my work Okta account. I received a confirmation email to my work address. To be honest I didn't look into the privacy implications closely because I assumed it was going to be a separate account.
Now I realise my personal account is linked to my work account, and in the profile page the email addresses are listed as follows:
[email protected]
[email protected]
(last used whenever I last logged in with Okta)[email protected]
Given how it is currently set up:
- Can admins of the team I have joined see my personal email address?
- Can someone with access to my work email account gain control of my personal Stack Exchange account (e.g. through password resets)?
- If my personal email account is compromised, can someone logging in as me access my work team (e.g. through password resets)?
- If I remove the
@work-domain.example.com
email addresses from my account, can I continue to participate in the team by logging in with my personal credentials?
This seems like it could open up a number of security issues (my personal email account providing access to my employer's private team/data and vice versa) unless there are robust controls in place for the above.