Why does my datascience.stackexchange automatically use someone else's profile? Is this a bug?

Question

First of all, I want to make it clear that my internet connection is through a shared VPN. Many different people get access to internet using a same VPN server. This might be the reason for the following issue, but I am still skeptical about it.

Several weeks ago, I created my Stack Overflow account using Google login. Today I realized that I have a question that should be asked on Data Science, so I opened datascience.stackexchange and was trying to join the community. It told me that I was about to create my account using a login from Google, which I am not surprised about, because my Stack Overflow account is still logged in (although my Google has logged out).

So I just clicked the button, and then I was shocked:

Instead of the common random pattern avatar, it was a photo of a man. Moreover, this account has a name V.J. (abbreviated to protect his privacy, as for now I am still not sure whether he is a hacker or a victim), which is definitely not my name. I also noticed that this account was created 3 months ago, which is ridiculous (I have just joined Stack Overflow for no more than 1 month ago, and never used any other Stack Exchange site except for this question).

I then wanted to change the avatar and the name, because it's not me! So I clicked "edit profile & settings". And then I had a new finding:

When I clicked "Change picture", instead of two choices between Identicon and Google (remember, I created my account using a Google account), it was Identicon and Facebook!

This is indicating that, this existing datascience.stackexchange account was created by Mr. V.J. 3 months ago using his Facebook account. Then why would Stack Exchange bind this account with my Stack Overflow account?

I can confirm that no one else has used my computer to log into Stack Overflow, and I never share my Google account with anyone else.

Interestingly, when I tried to do the same (use login from Google) to create an account on Meta Stack Exchange, it seems that everything worked as expected: I got a random avatar by default, instead of Mr. V.J.'s photo, and now I am using this account to ask this question.

Why would this happen?

Answer 1

Thanks for reporting this. It turned out to be an unlucky combination of multiple factors, namely:

1. Facebook providing us with a super weird unicode email address
2. That weird email making it into the database (bug on our end)
3. The merge code path not taking special care of empty email credentials (bug on our end)

So what happened was this:

1. User with an existing account, signed up, the weird credential making it into the DB
2. the next user without an email credential that signed in, ran into the merge check
3. the faulty SQL query matched his empty email credential with the weird unicode credential
4. a merge was attempted, but failed halfway through, still propagating the faulty email credential to account from 2.
5. the story repeated a few times (3 times); fortunately not too often, as most people do have an existing email credential
6. the user from 2. deleted the faulty email credential, and stopped the merges

A fix for this has been deployed in build 2018.9.19.31602 so this shouldn't happen again.

I'll look into unmerging the accounts, since the code we have in place today doesn't handle partial merges... Stay tuned...

Answer 2

m0sa & Adam Lear worked late to untangle the mess of merges; there are probably a few rough edges (such as the accounts list) but each person caught up in this should have their own account back at this point.

If anything else odd crops up, please let us know, either here or via /contact.