28

My employer recently invited me to join their new Stack Overflow for Teams instance. I was already signed into Stack Exchange with my personal account and I connected to my new work team via my work Okta account. I received a confirmation email to my work address. To be honest I didn't look into the privacy implications closely because I assumed it was going to be a separate account.

Now I realise my personal account is linked to my work account, and in the profile page the email addresses are listed as follows:

Given how it is currently set up:

  1. Can admins of the team I have joined see my personal email address?
  2. Can someone with access to my work email account gain control of my personal Stack Exchange account (e.g. through password resets)?
  3. If my personal email account is compromised, can someone logging in as me access my work team (e.g. through password resets)?
  4. If I remove the @work-domain.example.com email addresses from my account, can I continue to participate in the team by logging in with my personal credentials?

This seems like it could open up a number of security issues (my personal email account providing access to my employer's private team/data and vice versa) unless there are robust controls in place for the above.

7
  • 1
    Related.
    – yivi
    Commented Oct 26, 2020 at 18:25
  • 1
    I think the account reset by email is a very interesting and problematic aspect. I suspect that you can reset even a Teams account with you main email, I'm not sure if the password-reset dialog also takes your other emails linked to authentication providers. I personally find the approach by SE here fundamentally flawed, but they still seem to encourage mixing private and professional Teams accounts this way. Commented Oct 27, 2020 at 10:23
  • 1
    I did post a somwhat related question quite a while ago, but never got an answer. There are a bunch of potential ways the coupling between SO and Teams accounts could leak information. I mostly considered this from the other side, what information might be leaked to SO mods and users, but your version about what your employer might be able to do or see is potentially even more concerning. Commented Oct 27, 2020 at 10:31
  • 1
    Thanks for your comments. Perhaps someone here with team admin permissions and a friendly colleague who agrees to viewing their personal profile data could help to explore how this looks from an admin point of view?
    – fazy
    Commented Oct 27, 2020 at 11:42
  • 1
    Am I understanding this correctly? You were signed in with your private account and instead of signing out first, you signed in with your work credentials when joining the team and now those two accounts are linked?
    – Scratte
    Commented Oct 27, 2020 at 15:37
  • 1
    Yes that's correct @Scratte. Admittedly I wasn't being as careful as usual so I didn't take note of the exact steps.
    – fazy
    Commented Oct 28, 2020 at 18:06
  • 4
    I confirmed that you can password reset from the company email and take over the account, see this meta post for the details Commented Nov 1, 2020 at 10:31

1 Answer 1

2
  1. As far as I can tell, no. I didn't find any admin tools that would show login methods for users apart from the user management that shows the company email address. From what I can tell, Team admins don't have access to the tools moderators on regular SE sites have.

  2. yes, see this meta post

  3. yes

  4. yes, as far as I can tell. I don't make any guarantees here, I can't be sure I understand all implications in this case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .