When a user wants to delete their account, if they have posted 0 or 1 times, their account is deleted immediately; otherwise, they have to wait 24 hours for their account to be deleted after requesting deletion.

Recently, we've been encountering a troll (visible to members of the Charcoal SO Team, 404 error for others) who deletes their account promptly after posting their trollish answer in order to evade the automated anti-recidivism systems. They seem to know that if a moderator deletes their account, a 14-day suspension will be recorded under the account, which will be "reinstated" by the system through their IP address if they recreate their account; deleting one's own account immediately after trolling is one way to bypass that, as it's not possible for a moderator to suspend a deleted account.

I believe that one of the reasons why we allow users to immediately self-delete their account after making one post is so that if users decide they don't want to use the site after just testing the waters, they'll have a faster time leaving. I believe it's mostly there for historical reasons, since back when it was implemented, users who didn't meet the criteria for immediate self-deletion had to contact SE to have their accounts deleted. I don't believe it has much utility anymore, since users can now start the 24-hour timer by themselves, immediately.

Should we restrict immediate self-deletion to those who've made only 0 posts (and not 0 or 1 posts)? (I would have suggested allowing immediate self-deletion for those whose one post is received positively, but this isn't a good idea given the specific nature of this particular troll, whose posts may be upvoted by users who don't know about them.)

Just to make it clear, this is not an actual request to do this. Rather, I want to gather opinions before filing an actual feature request.

  • 1
    Perhaps it could be no delay for 0 posts or 1 (self-?)deleted post. – Makyen May 4 '18 at 3:02
  • 4
    Can you summarize what is behind the restricted Charcoal link? – forest distrusts StackExchange May 4 '18 at 3:09
  • Maybe I've been missing some recent change, but I thought that account self deletion cannot be applied immediately without a cm request and should take at least 24hrs.. – πάντα ῥεῖ May 4 '18 at 3:09
  • @forest All the relevant details are here in this post; the user immediately deletes their account after posting in order to prevent a moderator from deleting or suspending their account. He makes use of a feature that allows users who've posted only once to immediately self-delete their accounts, without having to wait 24 hours. All the other details are irrelevant to this question. – Sonic the Anonymous Hedgehog May 4 '18 at 3:11
  • @πάνταῥεῖ Please read the middle sentence of the above comment. – Sonic the Anonymous Hedgehog May 4 '18 at 3:12
  • 2
    @SonictheInclusiveHedgehog The reason I wonder is because the severity of the trolling, as well as its frequency is relevant. If it's someone who, for the last couple days, has been posting off-topic immature jokes, that's a completely different situation compared to a dedicated troll who has been spamming dozens of highly offensive or abusive answers a day. – forest distrusts StackExchange May 4 '18 at 3:13
  • 1
    For non-Charcoal members, this certain user always posted a plagiarized answer on a bountied question and commented on their own post with pattern like "Please give the <n> bounty in <x> days because this answer is accepted and correct". – Meta Andrew T. May 4 '18 at 3:14
  • @SonictheInclusiveHedgehog Well, thanks for clarification. Do you have any evidence how often this feature is abused by identified trolls? The feature sounds reasonable for me as is. – πάντα ῥεῖ May 4 '18 at 3:14
  • @hey Is this the troll that is being referenced? That doesn't seem nearly severe enough to create more restrictions for genuine users. – forest distrusts StackExchange May 4 '18 at 3:16
  • @hey So deleting their account immediately doesn''t make much sense? – πάντα ῥεῖ May 4 '18 at 3:16
  • @forest That's actually not their only name. They've been going under this other name too: metasmoke.erwaysoftware.com/… – Sonic the Anonymous Hedgehog May 4 '18 at 3:17
  • 2
    Then I think an alternative solution should be found to deal with this. For example, restrict immediate deletion only if the user's first posts receive a spam flag. – forest distrusts StackExchange May 4 '18 at 3:20
  • 2
    @forest I'm proposing this solution because it's in line with what the team has implemented in the past. For instance, removing all links from stackexchange.com profile descriptions. – Sonic the Anonymous Hedgehog May 4 '18 at 3:24
  • 1
    Links were removed from SE profiles? But I see them all the time... Regardless, this solution appears too heavy-handed for a single spammer. Some people may make a mistake and need to very quickly destroy their account, e.g. for anonymity reasons. And some people just want to quickly get rid of their account. Although I can't follow the Charcoal link, it doesn't seem to me like this spammer is a particularly massive problem, but rather a pesky nuisance. – forest distrusts StackExchange May 4 '18 at 3:25
  • 2
    @tripleee I was referring to network profiles on stackexchange.com. All links are omitted from those. Site profiles still have links for users with 10+ rep. – Sonic the Anonymous Hedgehog May 4 '18 at 5:05

Instead of changing how account deletion works, can we give moderators the missing hook? Can we make a (post-account-deletion) spam/rude deletion or suspension still affect the account as if it hadn't been deleted yet? The system probably knows the credentials, email address, and IP addresses, even if that's not all exposed in the UI for deleted accounts. Can the system reach in and apply the same penalties to deleted accounts and their successors that it applies now to non-deleted accounts and their successors?

Some trolls jump around and this wouldn't help, but I've seen timely red flags and account suspensions hinder troll reincarnations, so it helps sometimes.

  • 2
    An auto alert for repeated account creations/deletions from the same IP address would be useful, too. It's uncommon, so it wouldn't make to much noise, I'd think. – Catija May 4 '18 at 15:30
  • 1
    As far as IP-address penalties for spam-posts go, that operates independently of author accounts (and has for years), so that already works - whatever network the post originated from will be penalized if it is spam-deleted even if the author's account is long gone (heck, even if they never created an account). – Shog9 May 9 '18 at 17:36
  • @Shog9 oh, did not know that -- great! – Monica Cellio May 9 '18 at 17:38
  • 1
    As a prolific anonymous editor, I've always known it applies for spam edits, but not spam posts. (cc @Shog9) – Sonic the Anonymous Hedgehog May 9 '18 at 17:46
  • Like Catija's proposal. Raise an automatic flag on rapid account deletion from a small range. – iBug says Reinstate Monica May 11 '18 at 3:20

Perhaps we could play Solomon, and split the baby...

What if we could allow user accounts to be soft deleted? As in, as far as the public is concerned the account disappears, but it's still hidden in the system for moderation purposes for some deliberately undisclosed amount of time.

Seems like that could be a win-win, good faith users can still delete their accounts immediately, or at least it looks that way, but we still have the ability to snare trolls.

  • 3
    I am not sure how this will work out with the new GDPR... – Suraj Rao May 4 '18 at 10:08
  • 3
    That's a much, much, much, MUCH bigger change to the system than is feasible. – Shog9 May 4 '18 at 13:44
  • @Shog9 wonder would it be such a big change even if soft-deletion only lasts for something like 40 minutes and resolves into normal hard-deletion after this delay expires (I picked this delay because it matches network-wide asking rate limit) – gnat May 4 '18 at 15:25
  • It means rewriting every query that touches Users to ignore "deleted" users. So... Kind of a big change regardless of how long the status persists. – Shog9 May 4 '18 at 15:30
  • @Shog9 I was thinking rather about "extracting" these soft-deleted users to a separate table, so that all existing queries stay as they are. I imagine that only thing to do with this new table would be to check when real-deletion timeout expires whether posts from this account triggered ant-recidivism-system – gnat May 4 '18 at 15:44
  • 14
    Or we could just delay deletion by 24 hours like we do for everyone else. That would be much, much simpler. – Shog9 May 4 '18 at 15:51
  • well, this way makes a very good sense to me and it indeed looks so much simpler. I would prefer shorter delay, because deletion of passer-by accounts takes away negative score trash they tend to bring. However, if it is difficult to maintain separate timeout for them, 24 hours would be an acceptable compromise. @Shog9 – gnat May 4 '18 at 20:50

I think the answer is no.

Mods can see deleted users. If there is such a problem, the mod should be able easily to ban the account belonging to the deleted user on a way, as if it had been a mod deletion.

I would like to mention: there is nothing what would avoid to use any freemail site to create many registrations and use them until the SE doesn't ban you until the eternity. Practically, until the large count of registration from the same domain remains below the radar, the attacker is free to "work".

The Wikipedia uses the solution for this problem, that with a banned user, also their IP address is banned (for a while). Getting many different IP addresses is far harder as getting many different email-addresses.

  • 2
    I'm aware of Wikipedia's autoblocking system, and we employ a similar thing here known as the Anti-Recidivism System, which kicks in when an IP address was ever signed into a suspended account. Now, moderator deletions of accounts employ a little workaround: they record a 14-day suspension at the same time of deletion, to force that system to kick in. The same doesn't happen with voluntary self-deletions. I don't believe it's possible for a mod to suspend a deleted account, and the only thing that can be done is if an SE employee edits the database to record a suspension. – Sonic the Anonymous Hedgehog May 4 '18 at 9:30
  • 6
    Mods can't do anything to a deleted account. All we see is a stub page. – Catija May 4 '18 at 11:10
  • @Catija It is sad, the idea was to allow it them. As far I know, the deleted user accounts have a timeout until an irrecoverable permanent deletion, maybe this might be made available to the mods, to "improve" these own-deletions into real mod-deletes. – peterh Jun 8 '18 at 20:25
  • I'm not sure what you mean by that. Other than some minor info attached to a manually deleted user's stub page, there's not really much of a difference between the two. There's nothing "improved" about it as far as I'm aware... – Catija Jun 8 '18 at 21:09
  • @Catija I think on this stub page (or anywhere, where you are giving deletions/suspensions) should exist some option to convert the auto-deletion to a mod-deletion. – peterh Jun 30 '18 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .