Hidden profiles are not hidden at all

Question

I just tried out the relatively new ability to hide profiles on certain sites, and it turns out that it doesn't really hide anything at all since the hidden profile still has a link to my network account.

Hidden profiles shouldn't have links to the network account at all, this will always break anonymity. Hiding them will leak the information that this is a hidden profile, but this is still far better than the complete lack of anonymity as it is now. The network profile also shouldn't show any hidden communities, to avoid leaking the connection from a non-hidden to a hidden one.

The page where you can hide communities states the following:

Hiding a community means other users will not see it in your Communities list and Top Network Posts. It does not, however, mean your activity here is completely private. Moderators and Stack Exchange employees can see your list of hidden communities. Other people may also be able to associate your presence on those communities with your public list in certain cases (via the API, for example).

This is extremely misleading since it gives the impression that the hidden profile is reasonably private except to moderators or SE employees. The only other compromise it mentions is the API, and even then only in "certain cases".

While the text allows many interpretations, it gives the impression that the major privacy leaks are moderators and some advanced API shenanigans. It doesn't say anything about an easy-to-find link on every profile that completely nullifies the feature.

Answer 1

Profiles on a user's Hidden Communities now hide the link to the network profile for everyone but the user and site moderators. Moderators on other sites will not see the link, but should be able to verify a connection to a user on their own site by following the link to the network profile.

---

We recently removed hidden communities from the network profile, but the link to the network profile is still present on "hidden" profile. As a result, someone who finds my hidden 3D Printing account can easily discover my participation on other sites that are not hidden. Short of hiding all my accounts there's no way to prevent someone linking my illicit 3D Printing hobby from my professional interests. So this isn't a path for finding hidden communities, but a method for verifying the connection once it's made.^*

Not stated directly in the question, but the real problems with including the link come when a malicious user tries to harm someone's more public life with something they've said on a site they hope will be more private. For instance, I might not want people to know I prefer killing mice with snap traps and therefore hide my Home Improvement account. But if that answer angers someone (I totally understand), they might feel it their duty to contact my employer (which crosses a line). Removing the link to the network profile won't prevent abuse, but it will erect a roadblock to it.

As I mentioned in another answer the point of network accounts is to make the network more accessible. However, I think we can do something similar to what we did with the network profile: remove the link on sites you've hidden for everyone except yourself and moderators.

The downside, as you mention, is that people who visit the profile you hope to keep separate will be able to deduce that you have hidden the account by the lack of a network profile link. I don't think there's any way around that since removing the link for all users would make a person's network profile difficult (even impossible) to discover.

In summary, I was opposed to the idea a few weeks ago, but thinking of it less as a privacy feature and more of a way to reduce or even eliminate certain types of abuse, I like it a lot more.

---

Footnote:

* The API and Area 51 are more convenient methods for finding a user's hidden profiles than scraping every profile with more than 100 reputation.