15

In the comments to Tim Post's arbitration update, a debate over potential abuse of the electronic opt-out unfolded because it is trivial to impersonate a profile.

But does this even matter? What harm could someone impersonating me in this matter do in the end?

6
  • 2
    JMHO, if someone impersonates you and opts-out, which is not your wish, then you might not have the options available which you chose. Conversely, from the other side of the coin, without having a secure measure in place, SE could possibly just say, "Oh, we never got the email, therefore it will just go to arbitration." which in actuality was not your wish. There's nothing there (supposedly) which confirms your wishes in a secure manner. That's my guess/take on it. May 10, 2018 at 14:22
  • @Pᴀᴜʟsᴛᴇʀ2 The former point would be assuming that SO can somehow use the e-mail as proof of you opting out against your will in the first place, which is not that clear to me. May 10, 2018 at 14:29
  • Note that Stack Overflow (currently) uses Gmail for their email addresses, which verifies DKIM signatures and SPF policies on incoming email, which means that spoofing a From email address isn't as trivial as some people may remember from decades past. (I assume Stack would confirm that the From address matches one on your account.)
    – Jeremy
    May 10, 2018 at 14:29
  • 1
    @user1114 Spoofing is not strictly necessary here as any address is permitted as the sender. See this comment. May 10, 2018 at 14:38
  • 3
    Oh. Fair. Still: you’re not legally bound by an email you didn’t send.
    – Jeremy
    May 10, 2018 at 14:46
  • And that's a big thing.
    – Journeyman Geek Mod
    May 12, 2018 at 0:19

1 Answer 1

13

IANAL, but not very much. It literally just prevents you from waiving your rights to legal action by any other means.

Now, with the very minor legal education I recieved, none of which makes me a lawyer, if someone impersonated you there's no real contract. There's certainly no meeting of the minds. You can literally go "Hey, I did not send that!" and while it's a hassle, if you both want arbitration, there should be no issue.

It's literally a very contrived scenario, more likely to cause a inadvertant DOS attack on the SE helpdesk system, rather than a spate of wrongful opt outs.

For this to work, the attacker would need the email addresses of the victims (and that's not publicly available), spoof their email, and hope they ignore any reply from SE.

In a sense for this to work there would need to be a distressingly large data breach at SE, or a rogue site mod would be needed.

SE would then need to blindly process these — ignoring the fact that the email was sent from another server. As someone who's run his own email server in the past, due to the sheer number of people abusing emails, it's less trivial to spoof emails, especially from well known domains than it used to be.

There's probably simpler ways to muck things up.

8
  • Regarding the spoofing, I did not see any requirements on the from address in Tim's post, so I suppose that would not even be needed May 10, 2018 at 14:33
  • 1
    I suspect that's an oversight in documentation as opposed to practice
    – Journeyman Geek Mod
    May 10, 2018 at 14:33
  • But yes, it would be simpler to just flood with requests from arbitrary emails and profiles.
    – Journeyman Geek Mod
    May 10, 2018 at 14:35
  • Apparently not: meta.stackexchange.com/posts/comments/1012491 (Re. the oversight theory.) May 10, 2018 at 14:35
  • ah alas. Still somewhat contrived but less so.
    – Journeyman Geek Mod
    May 10, 2018 at 14:36
  • @BaummitAugen - if indeed the email address from which the opt-out email is sent need not be currently associated with the account, then here's one possible risk: if Stack Overflow permanently associates the opt-out email address with the account as, say, an additional login (and we don't yet know what they will do with it), then the sender of the email may start getting our job offers or other stack overflow mails.
    – dbc
    May 10, 2018 at 21:02
  • It's still trivial to spoof emails given that you can use any email for SE. May 12, 2018 at 0:18
  • 1
    "if you both want arbitration, there should be no issue" Moreover, this is true even if you legitimately sent the opt-out notice to begin with. Opting out doesn't remove your option to seek arbitration, it merely prevents Stack from forcing you into arbitration.
    – jmbpiano
    May 15, 2018 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .