83

I've just been contacted by a recruitment agent, and when I asked from where he got my email address, he told me from "Stackoverflow".

I was under the impression that my email address was not publicly available, as per the section under my settings entitled Private information (not shown publicly)

It's bad enough that these dregs of the professional world need to exist in the first place, so how exactly did he get my email address from Stack Overflow / Stack Exchange? (That is assuming he did get it from here, which is not proven.)

14
  • 19
    I do not see your email address in your profile. Nor do I see a link to a StackCareers profile. A simple Google search for your user name turned up nothing personally identified from a quick glance. Commented May 6, 2015 at 15:20
  • 2
    Do you have any blogs/articles/websites that you run, that might have your email, that you may have mentioned in an SO post at some point?
    – Servy
    Commented May 6, 2015 at 15:24
  • 2
    I often get contacted with that kind of response where they "found" me via stackoverflow, but found my contact information elsewhere, usually from a leads site listing employees and business contact information. though, they've never hit my personal address in that way. (though my personal address is pretty easy to find)
    – Kevin B
    Commented May 6, 2015 at 15:24
  • 4
    Thanks all. @Servy, no I don't have a blog or any website with my email address on. Although I guess its highly possible it's somewhere out there in the interweb connected with my profession. I really hate recruitment agents - I know we all need a job, but I have difficulty working out why they all have to be money-grabbing self-interested moral vacuums
    – freefaller
    Commented May 6, 2015 at 15:27
  • 8
    The money-grabbing self-interested part I understand. As to being moral vacuums, hopefully none of us (employees and employers alike) are so desperate that we fall into that vortex.
    – Robert Harvey Mod
    Commented May 6, 2015 at 15:31
  • 4
    Did this recruiter use your real name or user name in the email? If they used your real name or sent a generic message that didn't use a name at all, then that you have an SO account was just a good guess.
    – BSMP
    Commented May 6, 2015 at 15:33
  • 2
    Good point @BSMP, they used my real name... which again, not publicly available... so it was just a bluff. (Edit, although saying that, my real name IS my email address!)
    – freefaller
    Commented May 6, 2015 at 15:36
  • If you search for your name plus the name of one of your employers, you might be able to find the leads site(s) with your info on it.
    – BSMP
    Commented May 6, 2015 at 15:38
  • 4
    OK, maybe a bit harsh @Robert, but in my experience they have nobody's interest at heart but their own - they generally don't care about "you", they care about the commission... and they'll do anything they can (moral or otherwise) to get it
    – freefaller
    Commented May 6, 2015 at 15:39
  • I used to be a contractor and while recruiters can be paid highly for doing very little, they do help one get jobs, often with a bigger salary than I'd have dared ask for! Some of them are very nice, and like everything else, use w caution; I'm no longer looking but I still get tons of emails and some phone calls also! Commented May 6, 2015 at 15:51
  • 9
    Related: Someone contacted me by email but my email is not public on Meta SE Commented May 6, 2015 at 16:35
  • 20
    @freefaller "my real name IS my email address!" Your parents were quite funny by adding an @ symbol and a dot into your name and managing all that without a space ;)
    – Artjom B.
    Commented May 6, 2015 at 21:07
  • 4
    Fairly trivial to figure out if he potentially got it from SE/SO. Ask him what your SO user name is. Since that is not your real name (I assume you're not really freefaller...) real name and email shouldn't be able to generate SO/SE username any more than it does the inverse.
    – Joe
    Commented May 6, 2015 at 21:29
  • 22
    @ArtjomB. Imagine going through all that trouble to name your child like that, just to find out the email address is already taken. Commented May 7, 2015 at 8:39

1 Answer 1

99

Your e-mail address is only accessible to a) Stack Exchange employees with database access and b) users with a diamond on sites where you have accounts.

The latter group are the moderators (elected or appointed) and Community Managers.

Each time we access your personal information it's logged so that we (as in SE and other moderators) can see who accessed what and when.

The recruiter must have got your e-mail from somewhere else (probably by buying a list he shouldn't have been buying or a list the other party shouldn't have been selling - but that's another issue) and said "Stack Overflow" as a convenient cover story.

If any moderator was found to be leaking private information they would have their diamond removed fairly quickly. I don't know what sanctions would be applied to an employee, but I would imagine they would be fairly severe.

11
  • 18
    Thanks for the confirmation Chris. Looks like I was suckered in with the mention of stackoverflow. I realise now that it was pretty unlikely stackexchange would be the culprit here! The recruiter appears to have become uncharacteristically quiet now I've pointed out he can't have got my email address from here. Sigh
    – freefaller
    Commented May 6, 2015 at 15:54
  • 4
    Is it worth the time to see which, if any, <> moderators have accessed freefaller's email information prior to 5 hours ago? Accounts on 10 sites, if all it takes is one diamond moderator to harvest email addresses... Commented May 6, 2015 at 21:13
  • 10
    Hmm. See comment above linking to another thing. MD5-to-email can take the auto-generated avatars and extract email addresses? Commented May 6, 2015 at 21:22
  • 1
    @Yakk, I believe that email hashes were removed from the data dump a while back, but someone could possibly take your autogenerated identicon and get the hash from it (?). IMO, Those identicons should not be generated based on your email, but from your username instead. Commented May 7, 2015 at 10:13
  • 8
    @Yakk moderators can see those audit events. Nobody viewed it before May 6th on both SO and MSO. (I can't comment on any of the other sites with accounts). Commented May 7, 2015 at 21:10
  • 3
    @JonasCz: Usernames are not unique; it would be pretty poor design if two users who selected the same username would therefore both automatically receive the same identicon . . .
    – ruakh
    Commented May 8, 2015 at 7:10
  • You can change your profile picture though. Plus, I've changed mine and I still occasionally run into people with the same one (it's not unique or anything, but it still happens).
    – Albzi
    Commented May 8, 2015 at 9:12
  • 1
    @JonasCz I think that identicons are generated from "email + some-secret-hardcoded-salt"
    – user11153
    Commented May 8, 2015 at 9:19
  • @user11153 No, it's only based on your email (MD5 of your email).
    – undone
    Commented May 8, 2015 at 15:44
  • 2
    By default, it's email (or IP) + salt, @undone. You can opt-in to the raw hashed version if you have a Gravatar account, but that's not done automatically anymore.
    – Shog9 Mod
    Commented May 9, 2015 at 16:23
  • 4
    "Each time we access your personal information it's logged so that we (as in SE and other moderators) can see who accessed what and when" -> Logging is one thing, but is someone actually looking at the logs? Or are there safeguards in place? For example, what would happen if I would access try to yank the email and IP address from every user on the site where I'm a mod? Would alarm-bells ring at SE HQ? Commented Mar 9, 2016 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .