6

This is a FAQ proposal. Its aim is to advise and better protect users across the Stack Exchange network but especially to users who can be as young as 13. It is hoped that this guide will help users make informed choices about their safety online and what to do if they happen to witness abusive behaviour on any Stack Exchange site.

  • How safe are my personal details/email address on Stack Exchange?

  • What information in my profile is visible to visitors?

  • If I'm scared for my safety because of what someone says on a Stack Exchange site or in chat, what can I do? Who do I contact?

  • What should I do if I see someone posting abusive comments on Stack Exchange?

Return to FAQ index

Improve this question
35
  • 12
    "How safe is our registered email address from hackers?" Isn't that more or less impossible to say? Hackers always find that one hole you never knew about. – Cerbrus Oct 18 '19 at 12:01
  • 12
    "What simple measures can we undertake to protect our privacy; to ensure our safety and that of our family?" Don't use personally identifiable information. – Cerbrus Oct 18 '19 at 12:02
  • 6
    Points 2 and 3 are basically the same. The last point is waaaaay too broad to address in a FAQ. – Cerbrus Oct 18 '19 at 12:03
  • And try to have firewalls between your various internet activities and between the internet and your actual life. Otherwise someone can construct a "composite" from your various activities. – DK Bose Oct 18 '19 at 12:03
  • 2
    It's a proposed FAQ, I'm not being polemic. Even something as simple as not giving your work email address is good advice. I think online security is something that should be mentioned in a FAQ. – Mari-Lou A Oct 18 '19 at 12:03
  • 4
    TIL: "polemic". I'm not trying to imply you were, but there are some issues with the bullet points. – Cerbrus Oct 18 '19 at 12:04
  • "How safe is our registered email address from hackers?" If you have accounts on another websites and those websites get data leaked (LinkedIn, 2016), your email is not "safe" anymore. – CaldeiraG Oct 18 '19 at 12:05
  • 5
    I know I'm preaching to the choir but you have to remember not every member in SE is a computer engineer or developer. The FAQ is also for ordinary people like me, not just SO engineers or scientists. – Mari-Lou A Oct 18 '19 at 12:08
  • 2
    @Mari-LouA: I'd suggest rewriting the questions to be more factual. "What information in my profile is visible to other people?" and "How do I report things?", instead of the apparent focus on hackers, trolls and stalkers. – Cerbrus Oct 18 '19 at 12:11
  • 2
    I'm sure there's a dupe for the personally identifiable information out there. – Cerbrus Oct 18 '19 at 12:17
  • 3
    Possible dupe target: How safe is our user identity?. Also related: this one – SecretAgentMan Oct 18 '19 at 12:21
  • 2
    You should assume your registered email "has been sold"/"will be sold" to other third parties. This is not a criticism on StackExchange, but sound advice when dealing with any company. Company ownership can change hands and new owners may want to monetise their email database if their TOC allows it (or if they feel they can get away with it). You should register with a disposable email address if you don't want your email address to be compromised. – Alex Oct 18 '19 at 13:16
  • 2
    "There is a need for this FAQ to help users who may feel belittled or humiliated on SE." Why's that? Is it different from being belittled or humiliated in real life? We should try not to coddle: it's actually harmful in the long run to do so. – Lightness Races in Orbit Nov 16 '19 at 17:00
  • 1
    @Mari-LouA I didn't say that at all. – Lightness Races in Orbit Nov 16 '19 at 18:17
  • 1
    @Mari I didn't say we shouldn't do it, I said we need to be very careful. Please stop rewriting my words then attributing the altered claims to me. – Lightness Races in Orbit Nov 16 '19 at 18:24
8

How safe is our registered email address from hackers?

Only an SE employee can answer this, but I would think it’s safe to assume reasonable measures are being taken as SE is a huge site and the last thing they need is for the security of a user’s information to come into question.

What information in my profile is visible to visitors?

You can see this by copying the link to your profile and viewing it in a browser while you’re not logged in.

If we are scared for our safety because of the things we see or read on a Stack Exchange site or in chat, what can we do? Who do we contact?

This is tough. I would start by contacting the CM team, but beyond that the only thing you can really do is stop using the stack.

If we are being stalked or bullied online, how should we react? What can Stack Exchange do?

Again, this one falls into the contact SE. However, if you are really in fear of being harmed or threatened, you should contact your local authorities where it’s appropriate to do so.

And finally:

  • Do not use your real name.
  • Do not use your real picture.
  • Do not give out your specific location.
  • Create an email account for just this site (or similar), and only use it for this site. Attach to that email account as little personally identifying information as possible.
Improve this answer
6
  • 2
    "but I would think its safe to assume reasonable measures are being taken" - History tells us it is not safe to assume anything of the sort. Nothing to do with SE in particular, but organisations skimp on security and get hacked all the time regardless of their sizes. – SolveIt Oct 18 '19 at 14:10
  • @SolveIt My answer is specific to SE. I am confident reasonable measures are being take to protect our personal data. If that were ever to be breached, this place would die. – Neo Oct 18 '19 at 14:35
  • 1
    Could you please specify how someone might contact the CM team, and maybe explain what the acronym stands for. I know that when I joined nearly six years ago, the acronyms were the worst. I had to Google everything, and then even that didn't always work, so I had to make intuitive guesses. This is the last time, I'll mention it, promise, but I have since edited the question, so the quoted bits no longer match. – Mari-Lou A Oct 19 '19 at 16:21
  • Not giving out your specific location may not be enough. It's easy to find someone's IP address via an embedded image, and from then, you may be able to find the school this person goes to, which is often enough to find the individual person posting through various other means. – The forest of Reinstate Monica Nov 18 '19 at 3:52
  • @MisterPositive Really? Even in view of the recent personal information data breach for SE which they never followed through on? What about the fact that you can get IP address and other browser information simply by having someone view your avatar? I'm not as optimistic about their security as you. – The forest of Reinstate Monica Nov 18 '19 at 4:01
  • I cannot upvote this with the misquotes. Sorry. – Mari-Lou A Nov 23 '19 at 8:06
5

I'll try to answer by points, with more generic idea toward the tittle at the end:

How safe is my email address on Stack Exchange?

As much as StackExchange is, as every system on the internet it may be hacked someday (I consider the question is not 'Will it be hacked?' but 'When will it be hacked?', so using a free mail service specifically for this site is the best option if that's your concern.

What information in my profile is visible to visitors?

you can check your profile url in incognito mode to see that by yourself

If I'm scared for my safety because of what someone says on a Stack Exchange site or in chat, what can I do? Who do I contact?

My gut feeling is: if the problem comes from a specific user, flag one of their post for moderator attention explaining your concerns.
If they have no post or if the problem is more generic with a room/situation, use the contact form

Sensible advice, courtesy of Snow: As soon as you feel uneasy, flag and disengage, stop answering in comments or leave the room.

How should I react if I see someone posting abusive comments on Stack Exchange?

For this one, same as above, flag for moderator or use the contact form and disengage.

For the last two points: disengaging can be hard when you feel wrongly accused but it's often a good solution to stop the other party discourse as well.

As a general advice, coming from a time where we valued internet anonymity:

  • Use a nickname
  • don't use a picture of yourself as avatar
  • don't give personal information (country as the most precise thing)

A bit off topic but I find it important: don't post too much pictures of your kids nor informations about them, they'll thank you later.

In brief: treat internet as a role play game where your character match your values but is a separate identity than your real life one.

Improve this answer
0
5

I am going to tell a true story based on my experience, and then give general answers at the end.

Someone I am close to is what I call 'YouTube famous' and was/is being harassed online. Through social media they found his parents / relatives names and by googling one of their names found a few years old arbitrary post for my uncle. On that post had a comment listing the address for the wake.

Skype a few years ago was very insecure. Third parties offered free services to lookup someone's IP address based on their Skype name or vise-versa. Online trolls used this person's Skype name to find relatives' profiles who had the same IP address (lived at the same address). Skype has since fixed this.

It led to weeks long prank calls & threats from various places, including emergency services & food delivery places.

I tried googling my own name and found that anyone could figure out where I worked based on my LinkedIn... without having a LinkedIn account. Luckily nothing has come of it, but I decided I'd rather not be apart of such an insecure social media platform (this is true today; try it yourself if you have an account, I'll explain at the bottom).

It's not enough to stay secure yourself. If trolls can figure out who you live with (e.g., a parent of a young person) they can try to use their information to find you.

Even an IP address is private information. Don't use insecure services that give this information willingly. Never give away personal information, even to 'professional/business' websites like LinkedIn.

To clarify on LinkedIn's insecurities, their website only allows users who are a member to view profiles, and profiles can be set to only allow friends/connections to view. However, the LinkedIn API itself is not secure. People have noticed this and setup their own websites which use LinkedIn's API and allow everyone to view anyone's account. Worst of all, the most popular of these websites has decent Google rankings and may appear when googling a persons name (as it did for me).

Improve this answer
5
  • 3
    @JJforTransparencyandMonica It may not be given away, but you can easily find out someone's IP by embedding an image (either in a post or your profile picture) under a server you control. – The forest of Reinstate Monica Nov 18 '19 at 6:37
  • Re "...based on my LinkedIn": LinkedIn what? LinkedIn profile? But that would required an account(?). Having a LinkedIn page open in the browser? Or something else? – P.Mort. - forgot Clay Shirky_q Nov 19 '19 at 2:23
  • @PeterMortensen It does not require an account. There are plenty of services online which use Linkedins APIs to view accounts. The api's linkedin uses are not actually secure, so you do not need an account nor need to be someones friend to view there private account (But to do so using the actual linkedin webpage you do). – dustytrash Nov 19 '19 at 2:45
  • Thanks, I see. Can you make the answer clearer on that (private LinkedIn accounts and leakage)? – P.Mort. - forgot Clay Shirky_q Nov 19 '19 at 17:46
  • @PeterMortensen Done. I might edit this post again later to separate Skype/LinkedIn from general advise. Although my true story involves these 2 companies, I'm sure lots of companies have serious privacy/security issues – dustytrash Nov 19 '19 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .