19

There are questions similar to this one, but they were asked before the new auto-login feature.
The answers on the older questions are outdated and simply suggest "just don't log in to the other site", however this is no longer possible.

And the older questions do not put this forward.

So due to now being automatically logged in, we no longer have the choice to not show if we're active on a site by not logging in to it.

Proposal

I suggest an option for users to hide the 'last seen' info from the public profile, in order to give them control over their private information regarding their online habits.

Improve this question
8
  • 9
    Consider re-opening this as it does have an entirely different argument to the supposed dupe(s). And resurrecting old questions to add new data/arguments will invalidate the answers, and so might be less useful than re-opening this and duping the older ones for this one.
    – James
    Commented Jul 9, 2015 at 1:38
  • 3
    It's still worth looking at both the old requests and supportive answers, which all explain the concerns of the users very well and did receive massive up-votes. Clearly this has been relevant for years now, and now is the time to finally get this resolved.
    – TehMacDawg
    Commented Jul 9, 2015 at 2:29
  • 2
    I don't see much of a use case for this.
    – bjb568
    Commented Jul 9, 2015 at 14:42
  • 4
    If this option is made available, please give a suggested option of just reducing the granularity, so it just says "last week", "last month", "last year", "two years ago", etc. without the tooltip giving the exact timestamp.
    – Mark Hurd
    Commented Jul 10, 2015 at 3:25
  • 1
    I've been harassed before when I quickly checked new questions on a site and happened to downvote a post. My "last seen" time was 1-to-1 with the time of the downvote, so it was pretty easy for the recipient of the vote to figure out I did it. Definitely violates the principle of vote anonymity. @bjb568 Keeping something private doesn't need a "use case", lack of something has no utility. Even if what I mention here was not an issue, why isn't it OK to keep your viewing private for its own sake?
    – user154510
    Commented Jul 17, 2015 at 18:55
  • 1
    Showing it in the first place requires use cases (and their benefits should outweigh the negatives), and the only ones I can think of involve only showing it to moderators rather than making it public.
    – user154510
    Commented Jul 17, 2015 at 18:58
  • @MatthewRead My use case is deciding whether to comment on a post that I find unclear. If the author was last seen in 2011, I will not bother articulating my comment to them.
    – user259867
    Commented Jul 17, 2015 at 19:07
  • @MatthewRead My point is that not many people are going to care. And you really shouldn't care that much about a single downvote.
    – bjb568
    Commented Jul 17, 2015 at 20:52

2 Answers 2

Reset to default
2

The answers on the older questions are outdated and simply suggest "just don't log in to the other site", however this is no longer possible.

This is possible. Despite the fact once you log in to some SE site you're automatically logged in anywhere, your "last seen" won't be updated, unless you visit the site directly.

I was interested myself in this, so I asked and got this official reply:

Your "seen" field will only be updated on the sites you actually visit.

So, in terms of you being seen on some sites or not, nothing has changed.

Improve this answer
2
  • 6
    The point is this: Before the changes, it was possible to visit a subdomain without being auto-logged in there and timestamped 'last seen', even if you were logged in on another subdomain. This may have been offered as an ad-hoc solution, that is, to back-burn the implementation of an option to hide the 'last seen' info. Because of the improved (enforced) auto-login now, this ad-hoc solution stopped working, so the situation did change, and the call for a 'hide last seen' option has gained even more in relevancy.
    – TehMacDawg
    Commented Jul 11, 2015 at 17:51
  • 5
    "your 'last seen' won't be updated, unless you visit the site directly." of course, the same as your car won't use petrol if you don't use it I think the point is being able to visit the sites and not be shown to have visited it ;)
    – James
    Commented Jul 12, 2015 at 20:02
2

I am surprised that the issue of "doxing" as part of a social engineering attack hasn't been mentioned more.

Scenario

  • Consider the scenario that it becomes evident (via psuedanonymous answers on stackexchange) that "Bob" is intimately familiar with a particular brand of routers/devolps using .NET/uses Firefox/provides other in-depth answers on a topic suggesting he's an employee at corporation x.

  • Answers on family.stackoverflow.com (under the same pseudonym) narrows his location in the world to a small section of a particular state, strengthening the likelihood of the assumptions above;

  • "Bob" also has a linked account (automatically merged... oops!) on hotsexysingles.stackoverflow.com which he is normally very careful about only accessing via a VPN (avoiding router logs!) on his home connection (otherwise browsing anonymously), but due to the auto-login now has a "last seen" of a few minutes ago (during work hours);

  • "Bob" had registered to several hundred so sites many years ago but never really interacted with many beyond passive lurking. Due to the auto-login feature combined with the "last seen" data, iterating through "Bob"'s other linked accounts (manually/automatically) it is now possible to determine that he has recently been looking at career, travel, and lgbt related so sites.

Harm

Given the presence of a 'last active' field, this may lead to manual/automatic enumeration of sites enumeration of "active" sites (vs "registered-but-never-actually-visit" sites).

While the scenario here became a bit more outlandish that I'd originally intended, the resulting harms that could arise here include blackmail, targeted phishing attacks, personal/corporate embarrassment, and assumptions being made about his upcoming career ambitions/personal life plans. As more sites begin to be included in the future (area51, careers, chat, etc..), this issue will be exacerbated.

Mitigation against this could previously have been achieved by explicitly choosing not to log in on that particular sub-site, thus avoiding triggering an update of "last active" data. Unfortunately, auto-login (thus auto-update of the 'last active' field) now leaks this snippet of data, through no explicit action of the user.

Improve this answer
4
  • 2
    "Last seen" doesn't update unless Bob actually visits those sites. Check my network profile, for example; some of the sites down at the bottom show "last seen" times of days or weeks ago (some longer), yet I am logged in here leaving this comment.
    – Monica Cellio
    Commented Jul 16, 2015 at 1:11
  • 2
    @MonicaCellio Well, yes, it is exactly because the 'last seen' time stamp is updated on the site you actually visit that this information needs to be protected from public access to prevent tracking, or stalking, if that word means more to you. Please remove your down-vote if you placed one erroneously based on initial incomprehension.
    – TehMacDawg
    Commented Jul 16, 2015 at 3:30
  • @TehMacDawg I won't remove my comment. This answer is based on a scenario where Bob carefully avoids visiting certain sites at work but is somehow shown as having visited at those times because of global login. That's not how it works, as demonstrated by the network profile of any user who doesn't visit each of his sites every day. Go look. If it did what you think it does that would be a problem, but it doesn't.
    – Monica Cellio
    Commented Jul 16, 2015 at 3:36
  • 1
    Rereading my post above I think it would benefit from editing, but to clarify @MonicaCellio : I agree that the updates to being "shown as having visited at those times" in the scenario is because Bob did actually visit those sites at the times recorded. The concern/issue is, instead, that Bob intended to do so anonymously, but due to auto-login that particular visit to 'site b' is now definitively/inadvertently associated with Bob on Bob's public profile due to Bob's previous visit to 'site a'.
    – kwah
    Commented Jul 17, 2015 at 0:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .