20

I discovered yesterday by staring at my asked questions that my main account asked this very poor question.

Honestly, I do not recall asking that question, and I do not recall ever working with Twitter gadgets anyway. Someone else then me asked it, probably using a tab I left open at work or something like that. Or did they?

I use Facebook to log on to my Stack Overflow account, and instantly changed my password after, but assuming someone could log into my Stack Overflow account using a Facebook tab I left open somewhere, or worse, by guessing my password, how bad can this use of my account by someone else be?

Considering I changed my Facebook password, is there any other steps I should take to ensure my account security?

15
  • 16
    Your computers at work don't have a screensaver that requires a password upon waking up?
    – user3920237
    Commented Dec 3, 2014 at 18:04
  • 29
    Do you care if your account gets banned, suspended, your posts deleted, your posts edited to be made incorrect, crap content of others upvoted, content of others you like being downvoted/un-upvoted, etc.?
    – Servy
    Commented Dec 3, 2014 at 18:04
  • 3
    yes I do, I'd rather say Commented Dec 3, 2014 at 18:06
  • 2
    Blame it on your brother, blame it on your brother! IIRC, Facebook has a feature that allows you to log out of all other instances if you're still concerned about it.
    – Compass
    Commented Dec 3, 2014 at 18:08
  • Yep, I unlogged all other devices Commented Dec 3, 2014 at 18:09
  • 6
    On top of that, I doubt that changing your password would help. They can't see your password simply by using your account. The problem here is that you let somebody access your machine.
    – user3920237
    Commented Dec 3, 2014 at 18:09
  • 13
    I've gone ahead and cleared all sessions for your account (you'll need to log back in), but it does look like that question was posted from your location. Either someone accessed your computer or something went wrong with an overly aggressive cache on your end.
    – Brad Larson Mod
    Commented Dec 3, 2014 at 18:23
  • 8
    @remyabel Changing your password helps in the event that someone guessed your password, rather than having access to your own machine. If you don't know how your account was compromised, it's a good safeguard to take.
    – Servy
    Commented Dec 3, 2014 at 18:54
  • 3
    It's not just bad for you, it's bad for the site as a whole if, say, a bad actor uses your apparently-trustworthy (reasonably high rep) account to edit spam into a couple posts. They're taking advantage of the trust Stack Overflow has in you (in your account). Commented Dec 3, 2014 at 23:14
  • @JeffreyBosboom be assured I'll be monitoring my activity very closely for the time being Commented Dec 3, 2014 at 23:49
  • 2
    Do not drink and SO!
    – crthompson
    Commented Dec 4, 2014 at 16:12
  • 12
    I use facebook No, Facebook uses YOU! :D Commented Dec 4, 2014 at 18:04
  • 4
    @TheBlueDog I think you meant to say, "In America, you use Facebook. In Soviet Russia, Facebook uses you!" Commented Dec 4, 2014 at 18:22
  • 1
    Well, if she was bad I hope she was really bad!
    – Hot Licks
    Commented Dec 4, 2014 at 18:46
  • @ThisSuitIsBlackNot: I thought about that the moment I'd posted it. Commented Dec 4, 2014 at 18:58

2 Answers 2

27

... but assuming someone could log into my Stack Overflow account using a Facebook tab I left open somewhere, or worse, by guessing my password, how bad can this use of my account by someone else be?

Considering that you're held responsible for any actions taken on your account, whether or not they were by you, I'd say...it can be pretty bad.

Suppose someone were to post a ton of inappropriate content under your name, resulting in your removal from the community. You could protest and say that someone was logged in as you, but that doesn't make you any less liable or less at fault - it was your account that was used, and you should be taking precautions to secure your account.

Considering I changed my Facebook password, is there any other steps I should take to ensure my account security?

SSO with two-step authentication (Google is one I use) isn't a bad idea. Locking your computer when you walk away from it is a good idea, too. Treat every account you have online like you would your bank account; do you really want just anyone to be able to poke around in that?

7
  • 3
    "Subscriber is solely responsible for any use of or action taken under Subscriber’s password" -- fortunately, thanks to OAuth, I don't have a StackExchange password. So no action could possibly be taken under a password that doesn't exidt ;-) Commented Dec 4, 2014 at 10:16
  • 2
    "Treat every account you have online like you would your bank account; do you really want just anyone to be able to poke around in that?" The difference is I don't have to worry about my bank account, because banks invariably auto-log your session out after a relatively small amount of inactivity. (Though it is still a good idea to configure any computer in a semi-public location like an office, to lock down the machine itself after a period of inactivity, anyway.)
    – neminem
    Commented Dec 4, 2014 at 16:00
  • 1
    You link to the legal section; "held responsible" seems to end at "account terminated." Not great, but hardly the end of the world. I also disagree some the second paragraph "You could protest and say that someone [stole your car], but that doesn't make you any less liable or less at fault - it was your [car] that was used, and you should be taking precautions to secure your [car]." Replace account with car, and I'm not sure it holds up very well.
    – Andy
    Commented Dec 4, 2014 at 18:14
  • 3
    @Andy I'm not so sure that analogy works. If you leave your account open to the public, it would be as if you left your car open with the keys still in the ignition. Likewise, if someone steals your account (hacking or otherwise), that would be more along your analogy.
    – Blaise
    Commented Dec 4, 2014 at 18:26
  • 3
    @Blaise Leaving your keys in the ignition does not mean someone can take your car without your permission... it'd still be theft.
    – Andy
    Commented Dec 4, 2014 at 18:41
  • 2
    @Andy It does mean that your insurance company may be off the hook for the loss. Depending on the jurisdiction, you as the car owner could even be fined for negligence. Commented Dec 4, 2014 at 19:10
  • 1
    see the OP's answer As a side note, we had a weird case with one of our apps where a bug in our code caused session bleed-over under very high load (or just the precise right timing). I suppose it's entirely possible that a similar corner case bug could exist in SO, or the unthinkable UUID collision happens or something of that sort. Commented Dec 5, 2014 at 21:49
12

Wow. I hope you'll find this funny even though I've called in the heavy cavalry and people used some of their time on this, but after BradLarson commented that "it does look like that question was posted from your location.", I've asked around and found that the culprit was...

... my dear father, on whose computer we frequently consult Stack Overflow when we're working. In the meantime I fixed his UTF-8 encoding problem, and we might create an account for him...

The accepted answer still remains the right course of actions if this situation was to appear for real...


How bad can someone other than me asking a question from my account be?

Servy commented:

Do you care if your account gets banned, suspended, your posts deleted, your posts edited to be made incorrect, crap content of others upvoted, content of others you like being downvoted/un-upvoted, etc.?

It can be very bad!

Are there any other steps I should take to ensure my account security?

Servy commented:

Changing your password helps in the event that someone guessed your password, rather than having access to your own machine. If you don't know how your account was compromised, it's a good safeguard to take

BradLarson commented:

I've gone ahead and cleared all sessions for your account (you'll need to log back in), but it does look like that question was posted from your location. Either someone accessed your computer or something went wrong with an overly aggressive cache on your end.

remyabel commented:

Your computers at work don't have a screensaver that requires a password upon waking up?

6
  • 11
    Your quotes should be cited.
    – Servy
    Commented Dec 3, 2014 at 19:12
  • are the upvotes on that comment a sign that I should cite each quote individually? Commented Dec 4, 2014 at 7:34
  • 5
    @FélixGagnon-Grenier Definitely. It's not entirely clear which comments belong to which poster the way you have them organized. e.g. I guessed that "Changing your password..." was from servy, "I've gone ahead..." was from remyabel, and "Your computers at work..." was from BradLarson. Oops!
    – Brian
    Commented Dec 4, 2014 at 16:24
  • Comments aren't meant to be kept. If you quote someone from a comment, cite the author. If you quote someone from a post, provide the link to that post. Commented Dec 4, 2014 at 17:50
  • 4
    This seems relevant: Police: Identity theft crimes most likely committed by someone victim knows ;) Commented Dec 4, 2014 at 21:02
  • 4
    In that case: Most browsers have a private browsing mode or incognito mode. Use it when not on your own computer. As soon as you close browser window, the cookies from that session delete, meaning you don't have to think of logging out of anything you opened. As a plus you don't have to think about "My father and I both have an account on this service. How do I log in onto my account without logging out my dad.". Private browsing is a seperate session, so both accounts can be logged in.
    – Sumurai8
    Commented Dec 6, 2014 at 12:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .