20

I encountered an interesting abuse of the system today where a user setup an account deletion. Knowing how long it would take for the deletion to process, immediately before it would become active, they began rapidly truncating and deleting their posts.

When the deletion went through, it severed the log of changes and required a manual review through a very large portion of their overall posts to undo the vandalism.

To prevent this, we should either delay the deletion when edits or post deletions are made to allow time for undoing vandalism or simply apply a block to editing and post deletion after requesting account deletion. (Alternately a suspension being automatically applied could also work.)

  • 1
    I think your idea with suspending a user who requested to have their account deleted until deletion is a good idea. A user who wants to have their account deleted doesn't need to be able to do anything. But cancelling the deletion should also lift the suspension. – Donald Duck Dec 15 '17 at 19:39
  • @DonaldDuck - yeah, the reason not to suspend and instead extend deletion would be for trying to get people to stay. If they are making posts still during that time, they might decide not to delete. If they are suspended outright, they are less likely to bother canceling it – AJ Henderson Dec 15 '17 at 19:47
  • Eh, this would have to be an additional check in the system. Issuing an automatic suspension means we have to have a wait to auto-unsuspend, which is definitely something we should avoid at all costs. We certainly don't want to even have the remote opportunity for a bug to get introduced there in the future and all of a sudden users can unsuspend themselves with the deletion system. Better safe than sorry. – animuson Dec 15 '17 at 20:21
  • 6
    Keep it simple: any action like editing or deleting a post will abort the countdown for deletion. Ideally with "Are you sure you want to edit/delete this post? This will abort your account deletion!" message before that. – Shadow Dec 15 '17 at 20:29
7

Another option, which might be more simple to implement, is such logic: once a user who requested account deletion and has the deletion timer ticking edits or deletes one of their posts, the deletion timer will be aborted. Not extended, no suspension, just aborted.

This must of course be well documented, and message better appear to the user before submitting edit or actually deleting a post, we already have such warnings in place e.g. users who are near a question ban.

But this would prevent any kind of abuse from the kind described in this question, and users who want a legit deletion will either leave their posts alone, or request to delete again after editing or deleting the post.

4

I've had to ask the CMs to speed up an account deletion request before because of a user complaining about having to wait an extended period of time to have their account deleted but I've also had users just request deletion and disappear.

But part of the point of the 24 hour delay is to give them the chance to reflect and reconsider their account deletion before it happens. Suspending them in the normal sense seems like it would be complicated and, in many cases, unnecessary.

I think it'd be more helpful if there were some way to preserve the user's recent activity log on the deletion stub so that moderators can review quickly if the user has been deleting or vandalizing their posts and have easy links at hand to revert those changes if necessary.

I'm hesitant to say that all edits and deletions should be prohibited because there could be legitimate reasons to do these actions - a sort of "getting your knitting in order" before you leave. Not all users remove their accounts because they're disgruntled and wish to wreak havoc on the way out.

But I also think that part of the problem here may have been the deletion process. For users with sufficiently high reputation or votes, this is done manually, not by the system. If this user fell into that category, this seems like a check that should be done before the account is actually deleted.

Perhaps site moderators should be given an alert for any users requesting their account be deleted who would trigger manual deletion and one of them should review the account before the deletion occurs, but not immediately upon the request for deletion, to make sure that none of this is being done. If it is, they can revert and suspend the user manually to prevent additional harm before a CM actually deletes the account.

This takes some of the work off of the CM's laps - a moderator can easily perform these checks and then give the account a "ready for deletion" stamp when the account hits 24 hours.

  • I've noticed a couple of times on SO where users have requested self-deletion and it appears to have just gone through despite a rather large number of posts. The old system was far too prohibitive for people to request deletion and required a lot of work and oversight. The new one though does seem a little bit too easy. – Jon Clements Dec 15 '17 at 20:42
  • Jon, I've noticed a lot of users on IPS will post something, and then immediately delete their accounts... if they have under a certain level of participation, there is no delay. So, really there are three levels of deletion... instant, 24 hour delay but automatic, 24 hour delay but manual. – Catija Dec 15 '17 at 20:43
  • I wonder if part of that could be the nature of IPS rather than trying to exploit anything... But yes, have seen that on SO. – Jon Clements Dec 15 '17 at 20:48
  • Oh, sure. A lot of people don't want IPS stuff to be trackable to their main accounts, so I think we get a lot of socks. I have a feeling that a lot of the one and done accounts are the same person - but the posts are good, so I'm not working at curbing it. – Catija Dec 15 '17 at 20:53
  • 2
    Something as simple as adding a "Last Modified Date" to the list of posts for a deleted user that already exists could help greatly there. Those column are already sortable on click, so an extra one would let moderators quickly see stuff that's been changed most recently without new pages. – animuson Dec 15 '17 at 20:59
  • 2
    If someone is "getting their knitting in order", couldn't we expect them to do that before triggering the 24-hour waiting period? – David Z Dec 15 '17 at 23:04
  • @DavidZ We can expect a good deal... that doesn't mean we will get it. – Catija Dec 15 '17 at 23:17
  • @Catija Sure, but in this case I mean locking out the account from posting, editing, or deleting anything during the 24-hour waiting period. – David Z Dec 15 '17 at 23:28
  • @DavidZ I'm sure the CMs can look at data but I'm guessing that, in most cases, that really isn't necessary. Personally I prefer to assume people will act in good faith and respond if necessary to those who don't. If this was happening the majority of times someone requested their account be deleted, it would be understandable but I don't think that's the case based on my limited experience. – Catija Dec 15 '17 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .