What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I had one account through Google with email X and another account through myopenid.com. I happened to add the same email X to this myopenid.com account. My intention was to stop using the Google account in favor of the new myopenid.com account.

After some time asking and answering questions with my openid.com account I am astonished to find out that it is now merged into my Google account. That creates all kinds of privacy issues. I thought the email on my Stack Overflow account was private.Did I miss anything here?

To be clear, I wanted to preserve my privacy in the second account, but now since all my recent questions were transferred to the old account, my privacy is completely lost.

And it looks like there is no verification for the email field in my profile. So if Stack Overflow is using that info to merge, there is a very serious security bug. If it is merging based on something else, that's even worse. I think your account belongs to that user here. Let me merge it. Terrible!

share|improve this question
1  
Merging will usually take place when there is abuse between the two accounts (eg. cross-voting). Did you do anything like that? –  Pëkka Mar 4 '13 at 18:21
5  
If you wanted to switch from a Google account to an open ID account, why wouldn't you want to take your questions/answers with you? –  David Robinson Mar 4 '13 at 18:21
5  
@Pekka웃 - As a side note, we don't do this anymore. Accounts are only merged on user request by the community staff or in automatic associations, like what happened here. –  Brad Larson Mar 4 '13 at 18:36
1  
@BradLarson It has happened to me very recently. It is my opinion that this is very bad as it hurts privacy badly. –  Astonished Mar 4 '13 at 18:39
    
@Pekka웃 I don't remember having verified those emails. I wonder what happens if I put your email address in my account, if my questions go to your account. –  Astonished Mar 4 '13 at 18:42
6  
So, openid.com let you add an email address without needing to log in and without needing to verify it? –  J. Steen Mar 4 '13 at 18:44
    
@J. Steen I think he's referring to the E-Mail address in your profile field. I was just able to change mine without any confirmation. I don't completely see through the process right now but that would obviously be a problem –  Pëkka Mar 4 '13 at 18:45
    
@Pekka웃 Well, he added the email from the first account to the second one (using openid) last, so I was assuming he was talking about that. Isn't it the login email that matters, anyway? –  J. Steen Mar 4 '13 at 18:46
add comment

1 Answer

This happens automatically. The process you followed is actually the one we recommend to folks who want to merge their accounts - you only need to contact us and give consent if you can't make the automated process work for some reason.

Having multiple accounts is not explicitly supported by the system (it's not forbidden, but you can't depend on it working either - particularly if your accounts interact in any way at all). Your email and credentials are private in that we don't share them with 3rd parties (see: Privacy Policy), but they're most definitely used to associate accounts; that's... kinda their primary purpose!

share|improve this answer
19  
Did I miss something here? Both of these accounts are yours, right? –  Shog9 Mar 4 '13 at 18:28
2  
@Astonished How would two different peoples accounts ever get merged? Your accounts used the same email address. That would impossible in any other scenario as the creating an account/changing and email address does not take affect until the link has been clicked within the cofirm email. –  Josh Mein Mar 4 '13 at 18:29
2  
@Astonished - I'm really wondering why it matters so much to you... was there a reason you needed two accounts? Seems like it's just more work for the DBAs. –  Mike Mar 4 '13 at 18:33
4  
@Astonished You couldn't use this to transfer your questions to another user. This only happens for logins with verified email addresses. –  Jeremy Banks Mar 4 '13 at 18:40
9  
@Astonished the email address on your profile is yours alone. No one can see it besides you and the owners of SO's databases.... so.. my email is on my profile, but you can't see it. If you give information to SO and they use it internally to manage databases and fix (what they may see as) discrepancies with accounts, how is that a breach of security? Where did you think your information was going when you typed it in? –  Mike Mar 4 '13 at 18:41
5  
@Astonished Why did you want to have multiple accounts? –  Etienne de Martel Mar 4 '13 at 18:45
3  
@Bart I don't seem to get a verification E-Mail when changing my address in my profile though? I just set it to an address that I've never used in a Stack Overflow context before, and the change seems to have gone through (see my Gravatar stackoverflow.com/users/187606/pekka) If that E-Mail field could really lead to account mergings, that would indeed be a problem –  Pëkka Mar 4 '13 at 18:47
2  
@Pekka웃 Facebook, Google and other trusted logins that have an associated email address implicitly verify that email address because Stack Exchange trusts that they send accurate information. –  Jeremy Banks Mar 4 '13 at 18:50
11  
@Astonished Your OpenID provider did verify the address with you. If we're talking about the OpenID associated E-Mail, then I don't think there is a problem here. I thought you were talking about the E-Mail address you can change in your profile. I don't see how this is a legal case either way, though, seeing as you specified the same E-Mail address both times. –  Pëkka Mar 4 '13 at 18:53
10  
If you logged into two different accounts using the same login, there's no information leak - I'm frankly @astonished to hear you think otherwise. If there's something else going on here, you should probably start by linking your actual account - based on your description here, this is a tempest in a teapot. –  Shog9 Mar 4 '13 at 18:56
5  
Well this escalated quickly... –  Tony The Lion Mar 4 '13 at 18:56
2  
@Astonished I was unable to reproduce this behaviour. I created a new Gmail account, and created a Meta Stack Overflow account with it. Then I created a MyOpenID account using the same email address -- but without verifying it -- and created a Meta Stack Overflow account with it as well. The accounts were not merged... –  Jeremy Banks Mar 4 '13 at 19:03
3  
@Pekka: although it's not entirely obvious, you can confirm your email address by opting in to various email-based functions on the site: inbox notifications and tag subscriptions both generate confirmation emails, I believe. Once that's done, the system "trusts" your address (until you change it of course). –  Shog9 Mar 4 '13 at 19:53
2  
@Astonished: I've mostly separated your accounts, and removed your email. You're correct that you can't add one account's email to another account, however you can log into one account with the email associated with another - if that email has been confirmed, the accounts may be merged. So far as I can tell, that's what happened here. –  Shog9 Mar 4 '13 at 19:54
2  
@Seth: if you use two accounts to do anything you couldn't do with a single account, that is a ToS violation and will result in one or more accounts being merged or deleted. If you don't... Meh. –  Shog9 Mar 4 '13 at 22:54
show 24 more comments

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .