1

When I click "Share" on a question or an answer, if I am logged in, a /{$account_id} is automatically appended to the link, probably for the Announcer family of badges [citation needed]. However, this account ID can be easily used for resolving the account name and other public details, simply through https://domain.stackexchange.com/users/{$account_id}.

This may lead to users accidentally leaking their account when they share the links. As far as I understand from a quick google on "StackExchange real name policy" and "StackExchange multiple accounts policies", StackExchange does not have any explicit stances on anonymity or having multiple virtual online identities, but this problem may accidentally make other people know about your StackExchange account as another virtual identity.

As a matter of fact, I only have one SE account, and as you can see, it is obviously anonymous from real life. Just now, I almost included my account name when sending it to a friend who doesn't know about this identity of mine.

Here I am suggesting three possible solutions:

  1. In account settings, set the preference not to include the account ID, but instead, like a non-logged-in visitor. This may, however, lead to the Announcer-family badges not working.
  2. Make a separate table (or whatever) in the database that maps numbers to question/answer IDs + user ID, so when a user clicks "share", a random/increment number is generated and mapped to the user's ID and question/answer ID.
  3. Simply encrypt the user ID with an internal key, then with the question/answer ID, i.e.:
share_link = 'https://domain.stackexchange.com/q/' + question_id + '/' + encrypt(
    key: question_id,
    message: encrypt(
        key: internal_key,
        message: user_id
    )
)
7
  • 3
    ... or you just delete the ID from the end of the link entirely before you share it.
    – Catija StaffMod
    Apr 9, 2017 at 3:36
  • 1
    You could use this userscript (and notice my user ID is in that link; I don't use that script ;)
    – zondo
    Apr 9, 2017 at 4:24
  • If you are so worried about privacy, then open post before sharing in private mode in browser. In this case link doesn't contain your id at all. Apr 9, 2017 at 4:42
  • Ever considered what happens with the SE app?
    – SOFe
    Apr 9, 2017 at 5:05
  • @Catija If you read my question carefully, the whole thing I am talking about is accidentally. Anyone with a working brain can deduce that the ID can be deleted, and even if not, can just be changed to anything.
    – SOFe
    Apr 9, 2017 at 5:07
  • You need to open post in private mode even if you already in private mode. We need to go deeper :) Apr 9, 2017 at 5:07
  • @alexolut nice idea. superuser.com/q/835213/542586 :P
    – SOFe
    Apr 9, 2017 at 5:09

1 Answer 1

1

The reason the user number is included is so SE can count references toward the Announcer badge family. Without the user number SE has no idea whom to credit with link referrals, so if you want the badges you have to use it.

But otherwise it's totally optional -- just delete it and the slash that comes before it. If you find yourself doing this a lot, you can use SOUP, the Stack Overflow Unofficial Patch to make this easier. The share link was recently modified to add this:

share links (user ID and anonymous)

5
  • 5
    I have never seen that. Are you sure that isn't a userscript?
    – zondo
    Apr 9, 2017 at 4:10
  • This probably does not solve the problem that I still want the Announcer badge :P
    – SOFe
    Apr 9, 2017 at 5:22
  • I didn't get this on any of the four sites I tried it on. Apr 9, 2017 at 7:28
  • SOUP?
    – Cai
    Apr 9, 2017 at 14:46
  • @zondo whoa. That showed up recently for me and I just assumed it was SE, because I'm not used to SOUP adding new features like that. (It's more about making things easier.) . Thanks; I'll update the answer. Apr 9, 2017 at 14:56

Not the answer you're looking for? Browse other questions tagged .