71

Author's Note: There are a couple of similar questions, but in both cases the answers cannot apply here.

  1. This question not a duplicate of: Is my email address accessible?
    The answer given there: "The recruiter must have got your e-mail from somewhere else" doesn't apply in this case.
  2. This question not a duplicate of: Recruiter claims to have gotten my email address from Stack Overflow
    The accepted answer in that case was that "the recruited was given the email by a (human) third party that the OP had corresponded with." That does not apply in my case.

The situation described in that post was different. Specifically that questioner had given the email to at least 1 third party, and the discussion focussed around the fact the third party presumably passed it on. I hadn't given the email to anyone else, and the information people offered here about the gravatar hash seems to be the only plausible explanation. My opinion is that questions that have different answers must be different questions. However the closure is probably unimportant now: I think this question has probably garnered as much helpful information from the mods and staff (and others) as is possible.

Is it possible for any third party to obtain my email address used to register for SO? I ask because I've today started receiving spam emails, coding related, sent to that address. However the address isn't used for any other purpose.

Details:
When registering with any site or company I use a unique email address of the form [email protected]. All email sent to [email protected] redirects to my real email by default, unless I specifically block individual addresses. When I registered here I used [email protected]. My sign-up on here was using email and password, not using one of the third party logins such as google or facebook. [email protected] has never been used elsewhere.

I've never corresponded with anyone on here using it (I can't even send from the address). I've never signed up elsewhere with that address. I don't use any sites linked to SO, such as the careers.

As far as I can see that address is only stored by SO, and on my email system. My email is stored locally, and only remains on my ISP's server for a few days. The last legitimate email I have from SO was in Feb 2013. I've previously received 2 sign-up emails, 1 from SO regarding the careers site and 2 when I reset my password.

Could the email have been harvested from my email system? It seems unlikely, since even if I had a security problem on my local computer, it would be remarkable that only that one email address, last used 3 years ago, was the only one targeted. And further that some scammer linked the address to SO, and sent coding related spam. In my experience coding related spam is rare: more often it's helpful people warning me about a problem with my bank account.

Could the address have been harvested from some intermediate server which handled a previous email sent to me at [email protected]? Same answer really: I couldn't answer technically, but finding a 3-year old address and sending appropriate spams to it seems surprising.

22
  • 9
    @Carpetsmoker: possibly, but again the accepted answer doesn't apply. In the question you link, the answer was that the recruiter got the email from a (human) third party that the OP had corresponded with using their SO email address. Unless I've had a major brain fart, this email address exists nowhere outside SO and my local email store. Commented Mar 26, 2016 at 10:39
  • 2
    So you have a specific [email protected] and have started receiving coding-related E-Mail exactly to that address recently? Might be worth taking up with [email protected]
    – Pekka
    Commented Mar 26, 2016 at 10:42
  • 2
    Only staff/moderators have access to a user's email and neither would (or are allowed to) disclose that to anyone. Could it be that someone got hold of your naming convention (maybe on a mailing list for another site/social network), put it together with a couple of other bits of info (googled your name - found your domain etc.. etc..) and then just look a punt?
    – Jon Clements Mod
    Commented Mar 26, 2016 at 10:42
  • 33
    It is a bit unfortunate but you might have fallen into the trap called Gravatar email hash as your account on PPCG seems to have that associated to your account and Gravatar had (or has) a known security flaw: meta.stackexchange.com/questions/21117/…
    – rene
    Commented Mar 26, 2016 at 10:42
  • 3
    I'd Google for that E-Mail address with site:stackoverflow.com just to exclude the possibility it's there after all somewhere, in a piece of code or something
    – Pekka
    Commented Mar 26, 2016 at 10:43
  • @Pekka웃 wouldn't googling that emailaddress not make things worse? Or do you trust Google, Inc?
    – rene
    Commented Mar 26, 2016 at 10:47
  • 3
    @Pekka웃 I tried searching - duckduckgo: no results for email. google: some random results for the words "my" "domain" and "overflow", nothing related to the email, or me. rene: i know searching potentially puts the email out there, but it's no big deal as I'll change my SO address and block the old one if I have further problems. Commented Mar 26, 2016 at 10:51
  • 2
    @Stuart yeah - this kind of case definitely warrants contacting them directly. They'll likely respond to this here, too, though, in due time.
    – Pekka
    Commented Mar 26, 2016 at 10:56
  • 2
    @JonClements: It's almost impossible to rule out some sort of guesswork. However googling my name doesn't return that domain. The domain isn't the one I use for my real email; nor is it one I put websites on. I have another domain I use for temporary/in-development sites. I couldn't swear I've never used the domain for anything else (I've used this system and these domains for many years), but it's generally just for incoming email. Such guesswork just seems rather low-volume for spammers. Commented Mar 26, 2016 at 10:57
  • 3
    @rene prior to their turning into Skynet in 2023, there is no record of Google being untrustworthy with privacy around search queries. Oh no I've revealed too much, please forget this right away
    – Pekka
    Commented Mar 26, 2016 at 11:06
  • 2
    @Stuart Well... after a couple of minutes of looking around - I was able to get your domain name easily enough. I think I can see how the "overflow" part was gathered, but heck - it's still at best a wild guess and a lot of cross-referencing and can't see how the heck automated scrapers would put that together...For one email address, I can't see anyone bothering with the effort - in fact - I've lost interest now - although still fairly curious :p
    – Jon Clements Mod
    Commented Mar 26, 2016 at 11:11
  • 12
    Judging from this meta post, they are getting a lot of complaints about this. Where there is smoke there is usually a fire. A ToS doesn't mean a toss to people that do this, it has no teeth. Commented Mar 26, 2016 at 13:27
  • 4
    @HansPassant: the email shouldn't have been scraped from my profile as it's not publicly visible - AFAIK only visible to mods and staff. According the the answer here for a mod to see someone's email they need to click an extra link and that action is logged. So even if someone got hold of a moderator's login and scraped all the info it would show up easily in the logs. Commented Mar 26, 2016 at 13:39
  • 15
    Other than today there are no entries in the audit log for moderators accessing your PII. Commented Mar 26, 2016 at 14:53
  • 2
    @Pekka웃: Yeah, no record anyone can find anyway. Commented Mar 27, 2016 at 1:52

1 Answer 1

24

Moderators and employees are forbidden to share any of your information. They refrain from doing so not so much it's because that's the rule, but because they're great people that hate recruiter spam too :)

We log all access to personally-identifying information. No one, employee or moderator, has viewed your email address prior to me to the time you posted this, which happened right now. A few mods saw this after you posted it, and double checked. comments So let's say the data warehouse knows your name, and maybe:

  • They bought a list of customers from a domain registrar, found your domain, and guessed at emails. Companies have invested tons of money in software that does these sorts of correlations from many, many sources.

  • They bought a list of customers from a hosting company, and did something similar

  • (From comments) They were able to find your avatar hash in a rainbow table, or noticed they didn't have it and put a GPU farm to work.

And by 'bought' I mean obtained with the presumption of no wrongdoing, because I'm a nice person and try to assume the best in folks.

I can say with 100% certainty that it did not come from us. This is one of the biggest reasons why we're very aggressively working to block these types of creepy crawlers - we can't have bad actors out there making people wonder if they misplaced their trust by giving it to us.

The weirder (and kinda creepier) scenario here is actually the simplest explanation - this is becoming much too common. You'll be hearing me saying some not-so-nice things about these outfits in the near future.

18
  • Before I looked up the definition I was wondering what sets of clothing you were talking about and why you would talk about them negatively. Commented Mar 27, 2016 at 16:16
  • 2
    I would never talk trash about my leisure suits. Never.
    – user50049
    Commented Mar 27, 2016 at 16:56
  • Thanks for the reply Tim. It's certainly possible someone got the domain and then tried guessing stuff. However they can't be banging out random emails, because [email protected] will reach me except for half a dozen I have blocked. Possibly the gravatar issue is an explanation there: if someone tried every domain in existence against a list of gravatar hashes. Commented Mar 27, 2016 at 16:57
  • @TimPost - one thing I'm curious about: you say no-one accessed my email before you? However Flexo strongly implied that moderators had accessed it yesterday in response to my question (quite understandably) Commented Mar 27, 2016 at 16:58
  • @StuartWhitehouse Rainbow tables do exist for those, I've never been shopping for them so I don't know how extensive they might be - but that could very well explain it. If it can help piece you together online, they'll pay top-dollar for it.
    – user50049
    Commented Mar 27, 2016 at 16:58
  • 1
    @StuartWhitehouse I just noticed that too. Access to PII is logged in a history table, which also shows the history of changes to email addresses. But, access to that history table is also logged on our end. Prior to yesterday, no one looked at your email directly, or that history table; I just emailed one of our engineering managers to make it so you can't see the emails in the history table, as having that access logged in two places is as undesirable as it is inconvenient for audit purposes. Still, I'm certain no one looked at it until you raised this concern.
    – user50049
    Commented Mar 27, 2016 at 17:05
  • I guess the final situation is we'll never know. The gravatar issue might be involved, but it must also have involved some curiously targeted guesswork. I've changed both my personal email on SO and notification one, although it seems I can't change my login email. Incidentally does anyone know how to ensure my updated email hash can't be visible via the gravatar issue? Commented Mar 27, 2016 at 17:13
  • @StuartWhitehouse Use a custom avatar, or an identicon. Gravatar goes by MD5, so it's always visible as the target in an <img> tag.
    – user50049
    Commented Mar 27, 2016 at 17:19
  • 4
    It's so awesome that you guys respond to support questions on an Easter Sunday - I wish other companies did that :-) Commented Mar 27, 2016 at 17:45
  • 9
    @JonasCz I don't mean to set precedence :) Many of us use our sites for our off-time stuff too. I've delighted in checking to see what's up on Meta during my spare time for the last six plus years .. I guess some things never change :) The company is pretty firm in its request that we do non-work stuff on weekends and holidays; it's just that for many of us, this was our non-work stuff prior to being hired.
    – user50049
    Commented Mar 27, 2016 at 18:22
  • 17
    This is actually really reassuring to hear that SO is defending my information from getting to unauthorized people. @TimPost I hope you guys realise just HOW valueable the big data is that you guys are sitting on. Datamongers must be salivating of what y'all could do with the stuff you could gather if you had less moral concerns.
    – Magisch
    Commented Mar 27, 2016 at 18:52
  • 15
    @Magisch we do. You'll very likely see me object and fight against this like Gordon Ramsay would object to rotten fish in the coming weeks. I'm at the point where I'm running out of the ability to be civil now. It makes me that angry. We're not a commodity to be sold, we're f**king people and I will fully use my position to advocate that. F**king rubbish is what it is.
    – user50049
    Commented Mar 27, 2016 at 19:41
  • 2
    @TimPost Yes, I can relate. I don't know why these corps are doing it either, because unsolicited low quality ads are the fastest express path to get me to never buy a product or consider working for a company ever in the future again.
    – Magisch
    Commented Mar 27, 2016 at 20:40
  • 3
    @TimPost I don't mean to add more anger and frustration and I really appreciate how you take action when you notice PII is leaked into a log table but I don't hear you address the possible gravatar route at a larger scale. If we assume the worst case scenario, shouldn't you consider all accounts that have a gravatar profile image now being compromised and with that use your powers to inform the users but also slam the door shut on that Gravatar route?
    – rene
    Commented Mar 27, 2016 at 20:43
  • 6
    @rene We did address this some time ago by allowing avatar uploads, with identicon being the default (depending on what we could guess that you might want depending on how you signed up). We're running some numbers now on how many are still using it, when I get some more details, I plan to open another discussion. A few conversations need to happen internally first, but I hate the idea of it making things easier for companies to stalk our users like this.
    – user50049
    Commented Mar 28, 2016 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .