14

In the comments to Tim Post's arbitration update, a debate over potential abuse of the electronic opt-out unfolded because it is trivial to impersonate a profile.

But does this even matter? What harm could someone impersonating me in this matter do in the end?

  • 2
    JMHO, if someone impersonates you and opts-out, which is not your wish, then you might not have the options available which you chose. Conversely, from the other side of the coin, without having a secure measure in place, SE could possibly just say, "Oh, we never got the email, therefore it will just go to arbitration." which in actuality was not your wish. There's nothing there (supposedly) which confirms your wishes in a secure manner. That's my guess/take on it. – Pᴀᴜʟsᴛᴇʀ2 May 10 '18 at 14:22
  • @Pᴀᴜʟsᴛᴇʀ2 The former point would be assuming that SO can somehow use the e-mail as proof of you opting out against your will in the first place, which is not that clear to me. – Baum mit Augen May 10 '18 at 14:29
  • Note that Stack Overflow (currently) uses Gmail for their email addresses, which verifies DKIM signatures and SPF policies on incoming email, which means that spoofing a From email address isn't as trivial as some people may remember from decades past. (I assume Stack would confirm that the From address matches one on your account.) – Jeremy Banks May 10 '18 at 14:29
  • 1
    @user1114 Spoofing is not strictly necessary here as any address is permitted as the sender. See this comment. – Baum mit Augen May 10 '18 at 14:38
  • 3
    Oh. Fair. Still: you’re not legally bound by an email you didn’t send. – Jeremy Banks May 10 '18 at 14:46
  • And that's a big thing. – Journeyman Geek May 12 '18 at 0:19
12

IANAL, but not very much. It literally just prevents you from waiving your rights to legal action by any other means.

Now, with the very minor legal education I recieved, none of which makes me a lawyer, if someone impersonated you there's no real contract. There's certainly no meeting of the minds. You can literally go "Hey, I did not send that!" and while it's a hassle, if you both want arbitration, there should be no issue.

It's literally a very contrived scenario, more likely to cause a inadvertant DOS attack on the SE helpdesk system, rather than a spate of wrongful opt outs.

For this to work, the attacker would need the email addresses of the victims (and that's not publicly available), spoof their email, and hope they ignore any reply from SE.

In a sense for this to work there would need to be a distressingly large data breach at SE, or a rogue site mod would be needed.

SE would then need to blindly process these — ignoring the fact that the email was sent from another server. As someone who's run his own email server in the past, due to the sheer number of people abusing emails, it's less trivial to spoof emails, especially from well known domains than it used to be.

There's probably simpler ways to muck things up.

  • Regarding the spoofing, I did not see any requirements on the from address in Tim's post, so I suppose that would not even be needed – Baum mit Augen May 10 '18 at 14:33
  • 1
    I suspect that's an oversight in documentation as opposed to practice – Journeyman Geek May 10 '18 at 14:33
  • But yes, it would be simpler to just flood with requests from arbitrary emails and profiles. – Journeyman Geek May 10 '18 at 14:35
  • Apparently not: meta.stackexchange.com/posts/comments/1012491 (Re. the oversight theory.) – Baum mit Augen May 10 '18 at 14:35
  • ah alas. Still somewhat contrived but less so. – Journeyman Geek May 10 '18 at 14:36
  • @BaummitAugen - if indeed the email address from which the opt-out email is sent need not be currently associated with the account, then here's one possible risk: if Stack Overflow permanently associates the opt-out email address with the account as, say, an additional login (and we don't yet know what they will do with it), then the sender of the email may start getting our job offers or other stack overflow mails. – dbc May 10 '18 at 21:02
  • It's still trivial to spoof emails given that you can use any email for SE. – forest May 12 '18 at 0:18
  • 1
    "if you both want arbitration, there should be no issue" Moreover, this is true even if you legitimately sent the opt-out notice to begin with. Opting out doesn't remove your option to seek arbitration, it merely prevents Stack from forcing you into arbitration. – jmbpiano May 15 '18 at 21:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .