11

First of all, I want to make it clear that my internet connection is through a shared VPN. Many different people get access to internet using a same VPN server. This might be the reason for the following issue, but I am still skeptical about it.

Several weeks ago, I created my Stack Overflow account using Google login. Today I realized that I have a question that should be asked on Data Science, so I opened datascience.stackexchange and was trying to join the community. It told me that I was about to create my account using a login from Google, which I am not surprised about, because my Stack Overflow account is still logged in (although my Google has logged out).

So I just clicked the button, and then I was shocked:

Instead of the common random pattern avatar, it was a photo of a man. Moreover, this account has a name V.J. (abbreviated to protect his privacy, as for now I am still not sure whether he is a hacker or a victim), which is definitely not my name. I also noticed that this account was created 3 months ago, which is ridiculous (I have just joined Stack Overflow for no more than 1 month ago, and never used any other Stack Exchange site except for this question).

I then wanted to change the avatar and the name, because it's not me! So I clicked "edit profile & settings". And then I had a new finding:

When I clicked "Change picture", instead of two choices between Identicon and Google (remember, I created my account using a Google account), it was Identicon and Facebook!

This is indicating that, this existing datascience.stackexchange account was created by Mr. V.J. 3 months ago using his Facebook account. Then why would Stack Exchange bind this account with my Stack Overflow account?

I can confirm that no one else has used my computer to log into Stack Overflow, and I never share my Google account with anyone else.

Interestingly, when I tried to do the same (use login from Google) to create an account on Meta Stack Exchange, it seems that everything worked as expected: I got a random avatar by default, instead of Mr. V.J.'s photo, and now I am using this account to ask this question.

Why would this happen?

  • 2
    I suggest you also use the contact page to inform the team privately, assuming this is indeed a security breach which are better handled in private. – rene Sep 19 '18 at 7:45
  • @rene thanks for your advice, do you think I should delete this question? – user10253771 Sep 19 '18 at 7:47
  • I let SE staff decide if this can stay or not. – rene Sep 19 '18 at 7:55
  • We're looking at this, by the way. It's indeed very weird, but it doesn't look like anything nefarious, more like a bug. Thanks for reporting this. I don't think your question needs to be deleted. – balpha Sep 19 '18 at 9:27
  • 1
    And thanks @rene for pinging me about this. – balpha Sep 19 '18 at 9:27
7

Thanks for reporting this. It turned out to be an unlucky combination of multiple factors, namely:

  1. Facebook providing us with a super weird unicode email address
  2. That weird email making it into the database (bug on our end)
  3. The merge code path not taking special care of empty email credentials (bug on our end)

So what happened was this:

  1. User with an existing account, signed up, the weird credential making it into the DB
  2. the next user without an email credential that signed in, ran into the merge check
  3. the faulty SQL query matched his empty email credential with the weird unicode credential
  4. a merge was attempted, but failed halfway through, still propagating the faulty email credential to account from 2.
  5. the story repeated a few times (3 times); fortunately not too often, as most people do have an existing email credential
  6. the user from 2. deleted the faulty email credential, and stopped the merges

A fix for this has been deployed in build 2018.9.19.31602 so this shouldn't happen again.

I'll look into unmerging the accounts, since the code we have in place today doesn't handle partial merges... Stay tuned...

  • Glad to hear that this bug has been fixed. To make it clear, there are now two Data Science accounts in my account list, and the one with 101 reputation belongs to Mr. V.J., please unmerge his account from mine, thanks. – user10253771 Sep 20 '18 at 0:39
  • @user10253771 Sorry about that! Your account ended up with a double entry in a table we use to keep track of basic stats about site profiles across different sites, but don't worry - it has no bearing on your ability to log in or use the sites; the side effects are purely cosmetic. I'll fix it up tomorrow if m0sa doesn't beat me to it. – Adam Lear Sep 20 '18 at 6:07
  • @user10253771 you should be all set now – m0sa Sep 20 '18 at 7:36
  • The bug is gone. Thank you all for the help! – user10253771 Sep 20 '18 at 9:57
2

m0sa & Adam Lear worked late to untangle the mess of merges; there are probably a few rough edges (such as the accounts list) but each person caught up in this should have their own account back at this point.

If anything else odd crops up, please let us know, either here or via /contact.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .