A recently deleted question about account deletion (meta 10k only) included some unresolved discussion about the requirements to delete an account that was cut short when the question was deleted.

The issue in a nutshell was:
How can an account deletion request be verified if there's no email address on the account?

You wouldn't want someone to be able to hijack an account and get it deleted, but you don't really want to require users to include an email address on their account either.

The deletion request form asks for an email, but it's not obvious that it needs to match the account.

The relevant FAQ doesn't mention email addresses.

Can accounts without email addresses be deleted?

  • The deletion request form does fill in with the email address on file with your account (if you have one there). – user102937 Sep 7 '12 at 23:41

Yes, accounts without email addresses can be deleted. It makes our lives easier if there is an email on file and the request comes from the same address, but we do not require it.

To delete an account just follow the steps listed in $site/help/user-deletion (e.g. http://stackoverflow.com/help/user-deletion). Don't skip step 1 like many people do.

We use your ability to sign into your account as the verification. Requiring an email address on top of that would be pointless - if your account is hijacked, the hijacker can change the email field anyway.

Last but not least, considering that you are signing in with an existing OpenID from Google or Facebook (or other providers, including ours), your account can only be hijacked by someone who took over your login credentials in the first place... so you likely have bigger problems than someone requesting the deletion your SE account.

  • We use your ability to sign into your account as the verification. To make sure I've understood, any email-less account is forcibly logged out and can then sign in again as verification? (As opposed to just taking the ability to change the display name as adequate verification without any extra signing in.) – blahdiblah Sep 8 '12 at 2:51
  • @blahdiblah We typically just check that the profile has been edited. If not, we ask for it to be edited. If this is a high-rep user and/or they reference a specific incident on a site, we do additional checks. – Adam Lear ModStaff Sep 8 '12 at 2:54
  • Wouldn't that leave open the possibility for Firesheep-style hijacking (for users that aren't high enough rep to warrant extra checks)? – blahdiblah Sep 8 '12 at 3:22
  • @blahdiblah Possibly, yes. There's any number of exploits that could happen. In general, I don't see someone taking that much effort to hijack someone's account just to have it deleted. If anything, I imagine folks would take the time to vandalize some posts first or something. That's the kind of random activity that triggers extra checks. Low-rep accounts just aren't worth taking over just to delete, y'know? Ideally, we'll eventually move to SSL and be immune to Firesheep. Until then, we do the best we can. (If all else fails, we can always retrieve and reassociate posts with a new account.) – Adam Lear ModStaff Sep 8 '12 at 3:29
  • You're probably right. Thanks for the comprehensive explanation. – blahdiblah Sep 8 '12 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .