6

This is something I've been thinking about since joining Stack Exchange a few years ago, and is something that might worry me about the future authenticity of answers.

Does Stack Exchange have any way to detect, mitigate, or otherwise stop people from handing over their account to another person?

The implications that I can come up with are many, and there are still more that I'm sure that I haven't thought of. The most concerning problem that arises from such a scenario is that this person could potentially take actions that they otherwise wouldn't have access to such as providing bounties, creating erroneous tags, meaninglessly down-voting questions, etc. If the errant user has enough reputation, they can even edit posts and gain access to trusted user tools for deletion and un-deletion.

Is there anything that can even be done in those situations or is this just "the nature of the beast"?

Edit: In reviewing the suggested duplicates to this post, I suppose the question should just focus on transferal of accounts due to any reason, instead of death in particular, because there are many ways in which someone might come into possession of another's account, and specifically focusing on just one aspect makes it harder for future users to research questions like this.

Improve this question
11
  • I can't find a link, but SE has given an official answer in the past about what actions are taken in such instances. Related thread here and also here.
    – bad_coder
    Commented Oct 19, 2020 at 23:18
  • 1
    Does this answer your question? How should a user's death be handled?
    – bad_coder
    Commented Oct 19, 2020 at 23:21
  • 4
    I feel that this question is relevant in spam fighting, because we've had a couple cases where a troll user has paid some inactive user with rep to use their account, to then spam and make troll posts without much hindrance. We initially suspected those accounts were compromised, but now we have reason to believe that that's what's happening.
    – Sonic the Anonymous Hedgehog
    Commented Oct 19, 2020 at 23:22
  • @SonictheMaskedWerehog those issues are dealt with in posts about SPAM and identity theft, together with abuse of system. Rephrasing the title of the question merely changes the subject to other duplicates. In which case the original question becomes off-topic.
    – bad_coder
    Commented Oct 19, 2020 at 23:29
  • 7
    What I have seen is that accounts that have reused passwords across different sites on the wider internet, are vulnerable to having their account hijacked by someone with access to breached password databases. What usually happens is that the hacker uses such accounts to vote for their own posts, or, in one case, post bounties to be awarded to their own posts. Bad actors are generally not that creative or devious to do anything else with “extra” accounts, TBH.
    – Martijn Pieters
    Commented Oct 19, 2020 at 23:32
  • @MartijnPieters That's generally the most common cause of spam/troll posts coming from high-rep accounts, but that's not always the case. See this post on the Charcoal team for an example case of my comment above.
    – Sonic the Anonymous Hedgehog
    Commented Oct 19, 2020 at 23:35
  • @SonictheMaskedWerehog how do you know a willing transfer was made? Have you ruled out hijacking?
    – Martijn Pieters
    Commented Oct 19, 2020 at 23:35
  • 2
    @SonictheMaskedWerehogi think you meant to link to stackoverflow.com/c/charcoal/a/4/114 there; I know those two posts are cross-referenced, but that was confusing for a moment. And I can’t find more info on that alleged case, so can’t investigate further. I have worked with staff on several password-reuse-hijack cases, there are a few specific markers that good indicators that moderators can look for.
    – Martijn Pieters
    Commented Oct 19, 2020 at 23:46
  • Except in the case of a single instance of actions by an Executor, it's forbidden - so this question is a dupe of this or that.
    – Rob
    Commented Oct 20, 2020 at 0:41
  • 1
    Is it possible to detect different users at the same keyboard?: Yes and Yes. If your question is solely about "SE using detection": SE tries to detect: meta.stackexchange.com/a/231893/282094 (not very clear about it), but ultimately, impersonation is not allowed.
    – Rob
    Commented Oct 20, 2020 at 4:22
  • Just from a practical standpoint, I don't think it would be necessary to detect users on the same keyboard because there is precedent for actions undertaken 'by someone else using my account', which I feel answer that aspect of the question. What about a concrete example where we know that a user cannot possibly be the same person that created the account (suppose stackoverflow is operating 250 years in the future and the account has a similar age, unless natural human lifespan also increases to that milestone, we can safely assume a transfer has happened)
    – Stephen
    Commented Oct 20, 2020 at 16:31

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .