33

So, someone had a bit of a startle the other day after realizing someone was trying to troll them by creating a parody profile. These shenanigans are fortunately pretty rare in that they actually turn out to be real monkey business afoot.

A more common support case is folks actually forgetting that they did something to their profile, and contacting us to figure out why it changed. Because when you remove your email address, sending you email gets kind of complicated.

So, why don't we show you (the authorized account owner) a 30 day audit trail of updates to your account? This way you'd know when:

  • You logged in, and from where
  • You logged out, and from where
  • Your profile was edited, and from where
  • Password reset was initiated, and from where
  • Probably a few things I'm forgetting

It could live on a tab in this neighborhood:

enter image description here

.. and it might be worth linking to from certain places within the profile.

A caveat to this is that moderators can log you out, and edit your profile. So we have to be careful not to reveal the IP of a moderator to someone else in those events, just show that a moderator did it (and who the mod was).

While this would be something that the more security conscious of you would enjoy, it's mostly designed to alleviate confusion and unnecessary stress. Oh, yeah, I stayed logged-in on a public computer at work; that's why I'm asking about VB.NET but code in Python! This happens more often than you'd think.

Anything missing? Did I overlook something that would make this idea horribad? It's been bugging me for a while that we don't have something like this, and I was reminded of that yesterday.

  • 7
    Is showing who the mod/CM was necessary? It's not shown in the flag history thing (and I don't see any value showing it there). If there's an issue with the logout or edit, pretty sure the right course of action is the "contact us" form, not a targeted mod vandetta. – Mat Jan 19 '16 at 7:29
  • 1
    @Mat I thought about that, and I'm not 100% sure. Making an edit to your profile is a bit different than validating or rejecting a flag, so I see a definite use for 'a mod did it', I'm not terribly married to showing which mod did it. I'd love more feedback from mods. – Tim Post Jan 19 '16 at 7:56
8

I generally like the idea, I have only a minor concern.

The logged IPs aren't entirely reliable, it could scare users if they suddenly see that a Cloudflare IP or an internal SE IP has accessed their accounts. I'm not sure if this is still an issue, but it happened in the past and logging the wrong IP would have much more of an impact when it is user-visible.

I don't have a strong opinion on revealing the moderator who edited a profile. If I edit a profile, I'm likely sending a moderator message as well and that one identifies me anyway. But it also isn't really necessary or useful here to know which moderator edited the profile.

  • We have the cloudflare thing fixed, but if something changes on their side that un-fixes it on our side, it could raise unnecessary consternation. It's something to consider, thanks for your input. – Tim Post Jan 19 '16 at 9:12
6

When I edit out content, I'd usually have no qualms with the user seeing my name next to the edit. If the user wants to bring it to meta, they can; we generally need to have a reason to edit it in the first place.

However, there are a few serial bad actors, and occasional immature users who would probably go crazy, but this can probably be handled as usual.

The only real problem I can see here is that the check shouldn't check if the user is a mod (e.g. When someone drops their diamond, what then?), but just hide ips for any user who is not the user of that profile.

6

You said that it should go alongside these tabs in the 'Activity page':

tabs on activity page

But shouldn't it go on the 'Edit Profile and Settings' page?

Advantages:

  • Consistent with other websites (most websites have this info in their settings page)
  • Consistent with the other tabs (every tab except responses and votes is public, while login info would not)

Disadvantages

  • The page is called 'Activity'...
  • Less visibility (Activity is the default page, and the Settings page is visited infrequently). This could be made prominent with a notification that gets sent to your inbox or email whenever you logon from a new location.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .