23

My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not using Gravatar.

Despite having taken reasonable precautions to preserve my privacy, I received unsolicited commercial e-mail from [email protected] on 2016-12-21 and [email protected] on 2017-01-11. Both messages were advertising products and events to a general audience, not directed personally to me. They were also "profesionally" sent from the mail servers of a marketing firm called Marketo, with DKIM signatures from both s=m1; d=tibco.com and s=m1; d=mktdns.com.

How did they obtain my e-mail address? Has Stack Exchange been hacked or phished? Was there a rogue employee or moderator?

I believe that this is not a duplicate of…

Improve this question
7
  • I would ask tibco where they got the email from.
    – DavidPostill
    Commented Jan 11, 2017 at 18:45
  • I assume you're using Stack Exchange OpenID to log in?
    – Shadow Wizard
    Commented Jan 11, 2017 at 18:48
  • @ShadowWizard Yes, I'm using Stack Exchange OpenID.
    – 200_success
    Commented Jan 11, 2017 at 18:48
  • There was a Developer Story leak, but it shouldn't have affected you since you set yours to private.
    – Laurel
    Commented Jan 11, 2017 at 19:58
  • Even if "moderator went rogue" as you define it and sold email addresses to spammers (very unlikely scenario, but who knows... we're all human) I don't think the team has any way to know/prove this.
    – Shadow Wizard
    Commented Jan 11, 2017 at 20:03
  • @ShadowWizard Access to personally identifiable information by moderators is logged. Presumably, there would be a large batch of such accesses, if someone were harvesting any significant number of addresses.
    – 200_success
    Commented Jan 11, 2017 at 20:06
  • @200_success well, in theory such a rogue can just take few emails, of top selected users (you are, after all, #1 on Code Review), to not raise suspicion. But now with Shog's answer, that's even less likely the case.
    – Shadow Wizard
    Commented Jan 11, 2017 at 20:16

1 Answer 1

Reset to default
16

Could've still been the Gravatar thing, if you were using that particular email with Gravatar back before we started salting them.

For several years, the hash that's used to generate the Gravatar image was published regularly in the data-dumps. We don't do that anymore - as your first related link states - but the data from those old dumps is still out there.

And of course, anyone who scraped the sites back in those days would've ended up with a whole bunch of email hashes too.

Hard to be sure about this, I'm afraid... But it's not impossible; a check of your account history suggests you used the default Gravatar image - with the hash associated with your email - until March of 2014.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .