Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked. The email suggested I'll star a bug \ feature request on chromium website. The request is totally legit and I don't mind it at all, my main concern is that my email is somewhat exposed on Stack Overflow.
I emailed this guy back and asked him where did he get my email address from, he replied with "I made a long list of folks to email to tell about the bug report, so I don't remember specifics of any of them."
I'm sure that I'll get a lot of responses here saying that stack keeps our emails private but, the facts are:
- I never published \ used this email address on Stack Overflow beside my login.
- My user name is short and unique for Stack Overflow. (I don't use it on other sites what eliminates the chance that a Google search will show my email address for a specific user.. I don't think someone will do a search for a 3 letters username and expect to find anything)
- Googling my user name and my email address will return zero results.
Is it possible the Stack Overflow team using users emails for their own benefit?
I don't know how relevant that is but on this guy about.me site it says that he is an ex-Googler.
A grace period on the bounty has started so I'm adding here what I've got so far. Even if my SO login email is buried somewhere in the stack pages (which I still doubt) finding it, as we all figured out, isn't an easy task. I don't think that someone on his right mind (besides us :) ) would waste more than a minute to find someones email for something that minor such as staring a bug.
- There's a dead simple MD5 extractor that can revert any MD5 to its original string.
- The person that emailed me gained some kind of access to the SO user list
I've forwarded the email, as requested, to one of the SO team, maybe that will help us solve this mystery.
One of the users in the comments (@Arjan):
2 hours ago I left a comment on one of his answers,(he his referring to the person who emailed me. He found his SO username) to get his attention for this very question, and now the whole answer is gone.Okay, it was not a very good answer. But assuming he deleted himself, he knows about this very question now, but he did not respond -- yet
The comment above was written on the 24 of Nov. The user in question got his first 100 rep Association Bonus on meta on the 24 of Nov. He definitely saw the comment, deleted his answer, read this question and chose to ignore it.
You should all read hwlau answer which makes perfect sense and describes how vulnerable MD5 is and how people can use that to their advantage.