3

I had one account through Google with email X and another account through myopenid.com. I happened to add the same email X to this myopenid.com account. My intention was to stop using the Google account in favor of the new myopenid.com account.

After some time asking and answering questions with my openid.com account I am astonished to find out that it is now merged into my Google account. That creates all kinds of privacy issues. I thought the email on my Stack Overflow account was private. Did I miss anything here?

To be clear, I wanted to preserve my privacy in the second account, but now since all my recent questions were transferred to the old account, my privacy is completely lost.

And it looks like there is no verification for the email field in my profile, so if Stack Overflow is using that info to merge, there is a very serious security bug. If it is merging based on something else, that's even worse. I think your account belongs to that user here. Let me merge it. Terrible!

Improve this question
9
  • 2
    Merging will usually take place when there is abuse between the two accounts (eg. cross-voting). Did you do anything like that?
    – Pekka
    Commented Mar 4, 2013 at 18:21
  • 5
    If you wanted to switch from a Google account to an open ID account, why wouldn't you want to take your questions/answers with you?
    – David Robinson
    Commented Mar 4, 2013 at 18:21
  • 6
    @Pekka웃 - As a side note, we don't do this anymore. Accounts are only merged on user request by the community staff or in automatic associations, like what happened here.
    – Brad Larson Mod
    Commented Mar 4, 2013 at 18:36
  • 1
    @BradLarson It has happened to me very recently. It is my opinion that this is very bad as it hurts privacy badly.
    – Astonished
    Commented Mar 4, 2013 at 18:39
  • @Pekka웃 I don't remember having verified those emails. I wonder what happens if I put your email address in my account, if my questions go to your account.
    – Astonished
    Commented Mar 4, 2013 at 18:42
  • 6
    So, openid.com let you add an email address without needing to log in and without needing to verify it?
    – J. Steen
    Commented Mar 4, 2013 at 18:44
  • @J. Steen I think he's referring to the E-Mail address in your profile field. I was just able to change mine without any confirmation. I don't completely see through the process right now but that would obviously be a problem
    – Pekka
    Commented Mar 4, 2013 at 18:45
  • @Pekka웃 Well, he added the email from the first account to the second one (using openid) last, so I was assuming he was talking about that. Isn't it the login email that matters, anyway?
    – J. Steen
    Commented Mar 4, 2013 at 18:46
  • Someone posting on for example, Islam, or Judaism, or Christianity, or Politics may not want that account associated with their main account because it may harm their careers if bigots at their workplace become aware of their wrongthink.
    – Ben
    Commented Feb 26, 2018 at 19:54

2 Answers 2

Reset to default
27

This happens automatically. The process you followed is actually the one we recommend to folks who want to merge their accounts - you only need to contact us and give consent if you can't make the automated process work for some reason.

Having multiple accounts is not explicitly supported by the system (it's not forbidden, but you can't depend on it working either - particularly if your accounts interact in any way at all). Your email and credentials are private in that we don't share them with 3rd parties (see: Privacy Policy), but they're most definitely used to associate accounts; that's... kinda their primary purpose!

Improve this answer
40
  • 21
    Did I miss something here? Both of these accounts are yours, right?
    – Shog9
    Commented Mar 4, 2013 at 18:28
  • 4
    @Astonished How would two different peoples accounts ever get merged? Your accounts used the same email address. That would impossible in any other scenario as the creating an account/changing and email address does not take affect until the link has been clicked within the cofirm email.
    – Josh Mein
    Commented Mar 4, 2013 at 18:29
  • 2
    @Astonished - I'm really wondering why it matters so much to you... was there a reason you needed two accounts? Seems like it's just more work for the DBAs.
    – Mike
    Commented Mar 4, 2013 at 18:33
  • 4
    @Astonished You couldn't use this to transfer your questions to another user. This only happens for logins with verified email addresses.
    – Jeremy
    Commented Mar 4, 2013 at 18:40
  • 9
    @Astonished the email address on your profile is yours alone. No one can see it besides you and the owners of SO's databases.... so.. my email is on my profile, but you can't see it. If you give information to SO and they use it internally to manage databases and fix (what they may see as) discrepancies with accounts, how is that a breach of security? Where did you think your information was going when you typed it in?
    – Mike
    Commented Mar 4, 2013 at 18:41
  • 5
    @Astonished Why did you want to have multiple accounts?
    – Etienne de Martel
    Commented Mar 4, 2013 at 18:45
  • 3
    @Bart I don't seem to get a verification E-Mail when changing my address in my profile though? I just set it to an address that I've never used in a Stack Overflow context before, and the change seems to have gone through (see my Gravatar stackoverflow.com/users/187606/pekka) If that E-Mail field could really lead to account mergings, that would indeed be a problem
    – Pekka
    Commented Mar 4, 2013 at 18:47
  • 2
    @EtiennedeMartel It wasn't for any illegal activities, that's for sure. It was for privacy issues. And it is not illegal to have two accounts on stack overflow.
    – Astonished
    Commented Mar 4, 2013 at 18:48
  • 2
    @Pekka웃 Facebook, Google and other trusted logins that have an associated email address implicitly verify that email address because Stack Exchange trusts that they send accurate information.
    – Jeremy
    Commented Mar 4, 2013 at 18:50
  • 11
    @Astonished Your OpenID provider did verify the address with you. If we're talking about the OpenID associated E-Mail, then I don't think there is a problem here. I thought you were talking about the E-Mail address you can change in your profile. I don't see how this is a legal case either way, though, seeing as you specified the same E-Mail address both times.
    – Pekka
    Commented Mar 4, 2013 at 18:53
  • 11
    If you logged into two different accounts using the same login, there's no information leak - I'm frankly @astonished to hear you think otherwise. If there's something else going on here, you should probably start by linking your actual account - based on your description here, this is a tempest in a teapot.
    – Shog9
    Commented Mar 4, 2013 at 18:56
  • 5
    Well this escalated quickly...
    – Tony The Lion
    Commented Mar 4, 2013 at 18:56
  • 4
    @Pekka: although it's not entirely obvious, you can confirm your email address by opting in to various email-based functions on the site: inbox notifications and tag subscriptions both generate confirmation emails, I believe. Once that's done, the system "trusts" your address (until you change it of course).
    – Shog9
    Commented Mar 4, 2013 at 19:53
  • 3
    @Astonished: I've mostly separated your accounts, and removed your email. You're correct that you can't add one account's email to another account, however you can log into one account with the email associated with another - if that email has been confirmed, the accounts may be merged. So far as I can tell, that's what happened here.
    – Shog9
    Commented Mar 4, 2013 at 19:54
  • 3
    @Seth: if you use two accounts to do anything you couldn't do with a single account, that is a ToS violation and will result in one or more accounts being merged or deleted. If you don't... Meh.
    – Shog9
    Commented Mar 4, 2013 at 22:54
2

This is a bigger issue than "not supporting" different accounts with a verified email address in common. It's not that some feature failed to work, it's that the accounts were merged.

Of course accounts must never be automatically merged without explicit prompting and re-verification of all email addresses.

  • Wrongthink: Someone posting on for example, Islam, or Judaism, or Christianity, or Politics may not want that account associated with their main account because it may harm their careers if bigots at their workplace become aware of their wrongthink.

  • Work email addresses Email addresses don't necessarily belong to the same person for life. Often at work leavers' email addresses are redirected to a team member or shared mailbox: That's my practice when I've been in charge of that.

    Should Clever Bob's replacement Stupid Joe be able to take over his 10k reputation just because Clever Bob used a work email address as an alternate login? Maybe you think Clever Bob must not be so clever, but was it really made clear to Clever Bob that this was a possibility?

  • Old or obsolete addresses: Alternatively some freemail providers will re-issue email addresses which have not been logged into for a period of time. Unless you are affirmatively checking that the email is live every few months, you have no reason to assume it hasn't been reissued.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .