21

Today I got an email with a proposal to take a survey:


Enter image description here

But the URL of the questionnaire is pretty strange: https://stackoverflow.az1.qualtrics.com/jfe/form/SV_3RGiufc1FCXXXX

Who can confirm that this URL is valid and legal?

2
  • 3
    Read Take the 2019 Developer Survey or follow the banner on top of the page to the same survey.
    – BDL
    Commented Jan 24, 2019 at 14:04
  • 2
    Google can. Just type "qualtrics" into google, see what you get. Nothing strange about this link, it is merely really ugly. Far less ugly than the blob of Google analytics javascript you will see at the bottom of the page source of this very meta post though ;) Welcome to web 2.0!
    – Gimby
    Commented Jan 24, 2019 at 15:53

3 Answers 3

40

It definitely raises a red flag mentally when a site you usually login to sends an email with a link to another domain, especially one with odd parts like .az1, /jfe, etc.

Perhaps next year a redirecting shortlink (e.g. stackoverflow.com/survey2019) could be used so people can be sure it's not a phishing link. If the current form had asked for login details at the start, I'm willing to bet a lot of people would have entered them!

Edit: Apparently a redirecting shortlink may have been used (see conflicting info in comments), I didn't receive the email so can't verify.

6
  • There's already a shortlink. stackoverflow.com/dev-survey/start . It's the actual link provided in the blog, and in the pinned Meta post. Commented Jan 24, 2019 at 14:37
  • 34
    It's not in the email though, which is the only place where a phishing link would come from!
    – Jake Lee
    Commented Jan 24, 2019 at 14:38
  • We actually do use the stackoverflow.com/dev-survey/start URL in the email, but when you click it, it redirects to the Qualtrics page. Qualtrics is a third party software where we actually run the survey.
    – Anita Taylor Staff
    Commented Jan 24, 2019 at 19:15
  • @AnitaTaylor Really? I didn't get the email so was just working off the original post, sorry! Would still be nice if it was self hosted :)
    – Jake Lee
    Commented Jan 24, 2019 at 19:25
  • 1
    @JakeSteam @Anita that's what I have in email: https://itr-links.stackoverflow.email/u/click?_m=XXX&_e=XXX Commented Jan 25, 2019 at 0:03
  • @AndriiAbramov That's a standard URL tracking link from our third-party email service provider that allows us to measure clicks. It redirects to the stackoverflow.com/dev-survey/start URL, which then redirects to Qualtrics
    – Anita Taylor Staff
    Commented Jan 25, 2019 at 14:44
16

The only reason I'm posting this is to confirm, as an employee of the company, what Erik stated. We use Qualtrics to facilitate the survey.

We need folks to be logged in for shortlinks to function correctly, unless we just set up our own redirect service that just sends folks to Qualtrics with everything else on the URL passed through, which opens up a whole other set of nightmares to keep Nick Craver up at night.

That's not meant to make light of your concern, though, which I'll pass along. There's just no 'perfect' way of doing it that we've found yet.

3
  • 3
    I know everybody hates iframes, but wouldn't it an be an option here to make it clear that it is endorsed by SO.
    – visibleman
    Commented Jan 25, 2019 at 0:55
  • 2
    SO could just add next to or below the button "the survey is conducted by Qualtrics, the link will take you to their website" ;)
    – 7ochem
    Commented Jan 25, 2019 at 12:18
  • Yes @ochem7, but the point is that there so many different techniques for disguising senders, and scamming people to click on email links and it is difficult to keep up with them all. If there was some kind of visible landing page on a verified SO site it would make verification easier for the user.
    – visibleman
    Commented Jan 26, 2019 at 1:58
9

I can.

Qualtrics is a company providing research and data analysis solutions. SE uses their services for the survey.

The link is a fairly standard one. Note that you should redact it a bit, because it is personalized afaik.

4
  • Note that you should redact it a bit, because it is personalized afaik, thanks, but I have already replaced symbols. Commented Jan 24, 2019 at 14:20
  • Ah, couldn't tell if XXXX was actually a coincidence or not, good.
    – Erik A
    Commented Jan 24, 2019 at 14:23
  • What prohibits to create my own Qualtrics account and create malicious (phising) link? I believe SE but not malicious. Commented Jan 24, 2019 at 15:34
  • Not much, but the link would look different (not have stackoverflow. at the start, that's taken). You just need to not enter your account info in surveys, SE might ask you for your mail but no passwords (and if it's phishing they already have your mail). Hosting everything on-site with company-controlled domains is better of course, but often just not feasible. If anything, the ugly domain tells me it's not phishing because I could've registered a more realistic-looking one (stackoverflowsurvey.com is still available), and qualtrics accounts get blocked fast if used for phishing.
    – Erik A
    Commented Jan 24, 2019 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .