81

Recently, a question was posted which included the credentials for twelve accounts. Upon investigation, it appears those credentials are compromised accounts for Uplay (Ubisoft Connect), and frequently appear on sites trading in such information (example).

Now, obviously, this data is already out there. And the author of the post did nothing to highlight what the credentials are for. In fact, the post was about how to parse a list, and the credentials were merely included as sample data.

Nevertheless, I would assume:

  1. This information is being distributed without the consent or awareness of the account owners,
  2. The passwords may provide access to other resources associated with those email addresses,
  3. This information should not be redistributed on Stack Overflow.

Given that, I raised a custom flag to delete the post:

While the question of how to split this data might be on topic, the data itself appears to be from hacked/leaked account credentials posted online for Uplay (Ubisoft Connect) (example). It's doubtful this data was shared with the account owners consent. And, regardless, sharing these publicly almost certainly violates Ubisoft's TOS—though, admittedly, the purpose of the accounts isn't shared here.

This flag was declined, however, with the explanation that:

We can't enforce copyright. Ubisoft can request a DMCA removal

I imagine this was a simple oversight by a busy moderator, and would have been less likely had I been more focused and succinct in my custom flag. Lesson learned.

Still, I can't imagine this is content we want shared on Stack Overflow. Am I being overly sensitive to this issue? If not, can this post be reevaluated? It's currently closed as a duplicate, but I'd expect it should be deleted.

24
  • 22
    Yeah, apparently valid emails/ account credentials definitely deserve a privacy redaction... I think flagging was the right move, and that the mod made a mistake & misunderstood the situation.
    – zcoop98
    Commented Aug 5, 2021 at 19:54
  • 6
    I think your flag was poorly written and it wasn't actually clear what you wanted. You would've been better off editing the post to have mock emails/passwords and requesting redaction of the original revision. Commented Aug 5, 2021 at 19:56
  • 17
    The one critique I do have is that I think mentioning the "Ubisoft TOS" in the message was a little distracting and unnecessary– account credentials of any sort don't belong in posts, full stop. Your flag message ended up more complicated than it needed to be.
    – zcoop98
    Commented Aug 5, 2021 at 19:57
  • 4
    @Nick: I did consider editing the post, and have done that in the past with e.g. API keys. Of course, that just buries it behind the edit history. I'd think compromising information should be permanently deleted, not simply obscured. Commented Aug 5, 2021 at 20:02
  • 7
    @JeremyCaney Nick isn't saying that editing is the full solution– editing is a quick fix to help obscure it until it gets formally redacted.
    – zcoop98
    Commented Aug 5, 2021 at 20:04
  • 4
    @zcoop98, Nick: I completely agree, and do appreciate that feedback. I will be more focused and direct when using custom flags in the future. Looking back at my past flags, many of them have been overly verbose with extraneous detail. I need to be mindful that moderators are sorting through hundreds of these a day. Commented Aug 5, 2021 at 20:06
  • 5
    Well, the data have now been edited-out (courtesy of @zcoop98) and the post is now deleted. However, I think the original version should be redacted. In future, when raising custom flags, try to emphasize the issue in the first few words of your message; as others have said, moderators handle a lot of flags and clarity/brevity can be helpful to them. Commented Aug 5, 2021 at 20:17
  • 4
    In this case, opening your flag message like this may have been useful: "COMPROMISED CREDENTIALS! I doubt that the owners of these emails ever gave consent ..." Commented Aug 5, 2021 at 20:20
  • 1
    @AdrianMole: I'm glad to see it. I definitely don't take issue with my poorly written flag being declined—that's on me!—I just wanted to make sure the post was removed. Thank you everyone for the quick action and advice. Commented Aug 5, 2021 at 20:26
  • 6
    @AdrianMole Not sure caps is the right way to get on the good side of anyone, let alone a moderator ;) How about "Compromised credentials! I doubt those users volunteered this information. I've edited it to hide the compromised credentials. Please delete this post and arrange for permanent redaction of the first revision."?
    – Scratte
    Commented Aug 5, 2021 at 20:26
  • 1
    @Scratte The problem is that you can't (or, at least, I don't know how to) use bold for emphasis in the text of custom flags. So, block-caps is the next best option... Commented Aug 5, 2021 at 20:34
  • 4
    @AdrianMole I think most moderators understand markdown ;) Try " ****Compromised credentials!**** " ;)
    – Scratte
    Commented Aug 5, 2021 at 20:51
  • 1
    @MartinSmith: Yup! Zcoop98 blocked out the sensitive data, and then a community manager committed the edit as a redaction before deleting the post. Everything is now resolved. Commented Aug 6, 2021 at 17:00
  • 10
    IMO, much of what has been written here is what I'd term a cop out. The onus should never be up to the flagger to create a textual comment which must meet with the Moderators idea of how one should have been written, in order for that flag to be considered worthy. A flag containing minimal, poor, or excessive, explanation, should be enough for a Mod' to read the whole post and comments, and make a decision, with no further information from the flagger. I understand that the Mod's may have plenty to do, but that's not the fault of the flagger, it's the fault of users using the site incorrectly.
    – Compo
    Commented Aug 6, 2021 at 17:13
  • 2
    A Moderator is a person afforded special authority to enforce the rules of the site. When a member flags them, it is their responsibility to weigh up the evidence, i.e whatever was included in the 'flag commentary' and the entire content linked to that 'flag'. Within its content, they should ascertain whether any of the rules have been broken, and action accordingly. Everyone knows before taking on the role of Moderator that they aren't paid, so they should stop brinigng that up every time they've been caught out. Mods makes mistakes, so how about a little honesty? instead of the blame game!
    – Compo
    Commented Aug 9, 2021 at 12:47

3 Answers 3

69

The way your flag read, it sounded like a lot of other flags we see, where a user sees some data they don't want/think should be on SO and flags it for removal. We don't handle those types of requests (i.e. DMCA) because we can't determine if the data is stolen, copyrighted, etc. (there's a specific path for SO legal). But you're right, a redaction here would be useful, and a community manager has done so.

In the future I would phrase it more like

This user has posted some data that may be from a data leak. Since this seems to be real data about real users, it wouldn't be a bad idea to redact it just to be safe.

It's also useful if you make an edit to that end yourself. That way, we have a template for our redaction (if you've ever seen an "empty" edit in the revision list, that's usually why).

7
  • 2
    See also Is it against the rules to post login credentials in a question? with a long list of duplicate targets. Commented Aug 5, 2021 at 20:39
  • 3
    That's a really useful advice, and I appreciate you taking the time to share it. Commented Aug 5, 2021 at 20:52
  • 10
    Also using the terms "PII" and/or "sensitive" may help clue mods into the nature of the content.
    – TylerH
    Commented Aug 5, 2021 at 21:22
  • 3
    @TylerH I'd probably stick to PII; sensitive sounds too much like someone trying to mod-flag a DMCA or "I don't like it" takedown would use. Commented Aug 5, 2021 at 21:25
  • 3
    "Redaction" is not enough; the poster's account (not just the question!) should be nuked from orbit. A message needs to be sent to criminals.
    – Ian Kemp
    Commented Aug 6, 2021 at 8:38
  • 2
    @DanIsFiddlingByFirelight In the data world, "sensitive" pretty clearly refers to the nature of the data, not someone's feelings... that's been established for decades before computers were even a thing (e.g. sensitive documents/information vis a vis governments, etc.).
    – TylerH
    Commented Aug 6, 2021 at 16:21
  • @TylerH My point was to avoid using terms that people asking for takedowns that won't be approved are (mis)using when something more specific is available, because you want to avoid your request looking like something that should be unceremoniously tossed into the bitbucket. Commented Aug 6, 2021 at 17:19
30

While there's no harm in wanting to write better flags, I have to agree with Compo's latest comment here, as in general (and I say this in priv a lot) I do think we need to pay more attention to custom flags, even when there are hundreds of them, many of which are invalid. Do I take way too long to handle custom flags as a result of this? Maybe, and maybe hardly anybody appreciates it. But I do it because it's the right and respectful thing to do.

In particular your flag contained the phrase "hacked/leaked account credentials" which was enough that this flag should've been taken seriously, and not just written off as another "I don't like this" or chilling takedown request. We can't keep making this mistake. We need to do better.

In fairness, most such flags do get handled by us correctly, which may make these errors stick out more.

1
  • 4
    Just want to say thank you for trying to improve when you don't really have to =]
    – tux3
    Commented Aug 6, 2021 at 21:01
1

The post ought to be redacted, and the OP should be suspended for rule violations.

1
  • 1
    No suspension. Deletion. It's an account that was created explicitly to post a question about these stolen credentials, there is zero loss in nuking it.
    – Ian Kemp
    Commented Aug 8, 2021 at 8:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .