44

The "share" link underneath a post includes the sharing user's ID for the purposes of awarding the user with Announcer, Booster, and Publicist badges in case enough users from different IP addresses click on the link.

However, this has the side effect of publicly disclosing what the sharing user's account on the site is. While this is OK to many users, some users may not want to do this in some cases. The only workaround in this case is to manually remove the user ID portion of the link (or use a script that does so automatically, or follow the link while logged out, etc.). Except, then, the user won't qualify for the badges.

Can we please anonymize or hash this user ID, so that users can still continue to earn badges for sharing links, while not publicly indicating in plain text what the sharing user's account on the site is?

This is not a duplicate of Privacy leak in permalink? as that question simply asks about the user ID, and the answer (and declining reason) there is so that publicity badges can be supported. This request can be considered a reconsideration request of that one. Anonymizing or hashing the user ID will still allow for publicity badges (satisfying the declining reason there), while also resolving the privacy concerns raised in that request.

This has also come up in an interesting way: there have been cases where the badge has been misused to prank users: a prankster can take a shared link to a post, change the user ID to that of the prank target, and deliberately load the link from different VPN IP addresses to award them a publicity badge. While this may seem like a harmless prank, it can actually cause harm if the post was controversial or promoted negative ideas: it permanently marks the user as being associated with or potentially in support of the controversial ideas. Implementing this will also prevent such pranks or trolling.

Improve this question
18
  • 3
    There are users who have no problem sharing their personal information on a publicly accessible account, but have a problem when a link contains an ID to their publicly accessible information? I for myself care much about my personal information, that's why I don't write them publicly in the first place.
    – Tom
    Dec 13, 2019 at 16:28
  • 11
    @Tom The profile may not contain personal info, but people may not want to share a way to get to it even if it doesn't.
    – Sonic the Anonymous Hedgehog
    Dec 13, 2019 at 16:29
  • 3
    Noting that a sha 256 hash or something like that won't do, since all user ids are public and available in the dumps. It would be easy hash all user ids and see which one match. You'd have to have something like a secret salt on the server side.
    – aioobe
    Dec 14, 2019 at 0:16
  • 5
    This is a really good point and a worthwhile feature request. But the only way I can think of to really do it properly is to generate random tokens for each share link and remember what they are, but that can get very expensive (in storage) very quickly, as you don't know whether any given share link will even be used. Meh. It might easier to just have a user pref for enabling or disabling these trackable share links (so, when disabled, Share just gives you the basic URL). You don't get the badges then, but privacy often has a cost...
    – Lightness Races in Orbit
    Dec 14, 2019 at 12:30
  • 12
    Millions of users are unaware that if they copy a link to a question that they didn't ask nor answer nor comment, and email it to 50 coworkers, then 50 coworkers have the possibility to find out very personal things about them (health, secrets, finances, thoughts about coworkers, etc.) via their contributions across all SE sites. They thought their posts are anonymous, but they aren't anonymous anymore!
    – root
    Dec 15, 2019 at 0:53
  • 2
    This is particularly unexpected for people who use a generic username (Anonymous, user123, ...) for privacy reasons. Or people who don't remember what things and on which SE sites they posted with the same account.
    – root
    Dec 15, 2019 at 0:55
  • 1
    Many of those who do wonder why there are two numbers in an answer link may conclude that it's the question ID and the answer ID, or answer ID and date.
    – root
    Dec 15, 2019 at 0:56
  • 1
    @root A temporary workaround (I saw your deleted post) is to install the SOUP user script, which adds a clear note that the link includes one's user ID and gives an option to copy an anonymous link instead. (Note that due to SE software changes, this is currently broken on the stable version of the script; there's a fix in the development (beta) version, but it hasn't rolled out to the stable version yet.)
    – Sonic the Anonymous Hedgehog
    Dec 15, 2019 at 0:57
  • 4
    The default option should be the high-privacy one.
    – root
    Dec 15, 2019 at 0:58
  • 5
    How valuable would this feature be? It seems to me like it would be very rare that someone would think, "I don't want to share my user id, but boy do I want that badge!"
    – Tanner Swett
    Dec 15, 2019 at 20:34
  • 2
    Root's right - this is actually a pretty serious issue now I think about it
    – Lightness Races in Orbit
    Dec 16, 2019 at 12:05
  • 1
    Don't know why @aioobe's answer was downvoted - it's a good suggestion
    – Lightness Races in Orbit
    Dec 16, 2019 at 12:06
  • 4
    As pointed out earlier, the only way to do this properly is stupidly complicated and definitely not worth the effort. I think a request for a setting to disable including the user Id network wide by default is valid so that users can make sure they are protected if they so desire. But hashing is out of the question. Unless there's a different secret for each link, hashing does nothing whatsoever to protect privacy. That's why we stopped providing Gravatar hashes in SEDE and stopped using the user's email hash when they don't use Gravatar - it is not more secure.
    – animuson StaffMod
    Jul 9, 2020 at 4:40
  • 1
    As I said, that's stupidly complicated. At the point we need an entire database table for keeping track of those links, the badges are simply not worth having anymore. Better removed. Sorry, but you're just gonna have to live with not receiving the badges if you don't want your Id in the link. Nobody is gonna implement that.
    – animuson StaffMod
    Jul 9, 2020 at 5:30
  • 4
    I had an anonymous referee (writing their report for a paper I wrote) use a 'share' link in their referee report to link to some pertinent information on a SE site, and in this manner I learned their identity. In this instance, no harm was done. But I could imagine an SE link being used for a reference for a much more sensitive topic, and with a more controversial opinion.
    – David Roberts
    Jul 13, 2020 at 23:45

2 Answers 2

Reset to default
5
+50

It is outrageous that SE disrespects our privacy so much. Maybe they don't understand the implications yet. Some of the implications are (as discussed in the comments to this question):

  • Millions of users are unaware that if they copy a link to a question that they didn't ask nor answer nor comment, and email it to 50 coworkers, then 50 coworkers have the possibility to find out very personal things about them (health, secrets, finances, thoughts about coworkers, etc.) via their contributions across all SE sites.

    They thought their posts are anonymous if the username is anonymous, but the posts become non-anonymous in a very unexpected way. Their intention when sharing is not to expose their anonymous SE account, but rather to point to one answer on SE.

    While the share popup does include a prompt that the link includes one's user ID, it's easy for users to gloss over that note or not understand the significance of it. Additionally, it's possible to end up with a link containing one's user ID without ever being prompted of that fact, such as by right-clicking the share button and using the browser's option to copy the link.

  • What's additionally counterintuitive to non-tech-savvy people is that the page they link to doesn't reveal their SE account (for example if they didn't contribute there), but the URL to the page does.

  • This is particularly unexpected for people who use a generic username (Anonymous, user123, ...) specifically for privacy reasons. Or people who don't remember what things and on which SE sites they posted with the same account.

Jeff Atwood's answer about this glosses over these problems.

Improve this answer
20
  • 1
    Unfortunately (well, fortunately,) comments can't be downvoted, therefore there isn't much use in comparing the score of an answer and a comment. (not to mention... the answer received more upvotes than most of those comments did.)
    – Kevin B
    Jan 24, 2020 at 21:09
  • 7
    Your first bullet... users are explicitly made aware in the share dialog (as noted in the question) that the link will include their userid. the other two bullets are... well, redundant considering the response to the first bullet.
    – Kevin B
    Jan 24, 2020 at 21:20
  • 7
    There's no need to resort to hyperbole. Your privacy is not being "disrespected" because the ID is a part of an automatically generated URL. For the average, less-savvy passer-by, this isn't even a real concern; for those of us who know how to interpolate those IDs and can use them to link them to an actual account, at that point the amount of privacy you would expect when linking to your Stack Overflow account is what you put in your profile yourself.
    – Makoto
    Jan 24, 2020 at 21:49
  • @Makoto - He / She raises a good concern, just because we know its still NOT right. Many have links to other SE related sites that have some information we just don't want to publicly show to the world....yes I know I can create a throw away account but that is too much effort. How hard would it be when asking a question there could be a radio button question "Ask Anonymously?" and if it is clicked it does not link back to your account. I bet there is a lot of junk / garbage data of users creating so many accounts just to anon themselves. Just a thought...
    – JonH
    Jan 24, 2020 at 22:54
  • @JonH: At some layer, one must accept responsibility for linking social webs together. I don't disagree that it's deceptively easy to do that with Stack Overflow's question sharing, but at the same time, Stack Overflow didn't make the choice to share that link on your behalf, it only generated it. I don't want to detract from a possible privacy concern, but I genuinely believe that this OP's concerns are way overblown.
    – Makoto
    Jan 24, 2020 at 23:45
  • 2
    "coworkers have the possibility to find out very personal things about them (health, secrets, finances, thoughts about coworkers, etc.)" It's not like we can't get those from Twitter or Facebook already. Also if it's a secret you shouldn't be posting it on the internet.
    – Senior Wrangler
    Jan 25, 2020 at 2:21
  • 1
    @Renan You don't understand the problem here. If you post on Twitter under a pseudonym which you didn't share with anyone, nobody knows that it's you. This is not the case for SE. On SE, you can use a pseudonym, not share the pseudonym with anyone, and then have your secrets exposed in an extremely unexpected way.
    – root
    Jul 8, 2020 at 20:32
  • 5
    This can hardly be unexpected as the share pop-up clearly states the URL includes your userID.
    – Luuklag
    Jul 8, 2020 at 20:40
  • @root you're saying that if you post in SE with a pseudonym you have never shared with anyone, your coworkers will still be able to know it's you?
    – Senior Wrangler
    Jul 8, 2020 at 20:41
  • @Luuklag That pop-up could also state that now your house belongs to SE. Fineprint is not an excuse to violate privacy.
    – root
    Jul 8, 2020 at 20:42
  • @Renan Yes, indeed! The coworkers with whom you share such an SE link will be able to decode your SE account from the link. This is a privacy issue.
    – root
    Jul 8, 2020 at 20:43
  • Eh. Doxxing is a thing that happens on a depressingly regular basis, anonymous accounts or not.
    – fbueckert
    Jul 8, 2020 at 20:44
  • 1
    Why don't you share the link without your user id then? It works, i.e.: meta.stackexchange.com/a/342837
    – Senior Wrangler
    Jul 8, 2020 at 20:45
  • 3
    @root that depends on your definition of fine. To me this is normal sized print. It isnt hidden anywhere.
    – Luuklag
    Jul 8, 2020 at 21:32
  • 1
    @PM2Ring If you don't left-click the "share" button, and instead you right-click it and click "Copy link" (or "Copy shortcut" depending on your browser), you will end up with a link containing your user ID and no prompt (since you never opened the Share popup).
    – Sonic the Anonymous Hedgehog
    Jul 9, 2020 at 3:36
-2

Why this is problem?

Ok let me describe a hypothetical scenario. Say I was an active member of a mutually anonymous group that published opposition opinion pieces in some dictatorship without freedom of speech. I survive only by nobody knowing my true identity there. In parallel, in my normal life, I am a software professional with a StackOverflow account asking questions and giving answers in a safe way that doesn't belie my "secret" behaviour. One day, somebody on the anonymous group asks me a technical question. I find the answer on a StackOverflow question and post it. Boom, all my pseudonymity is gone; I'm dead.

Improve this answer
5
  • I really doubt that exposing your user ID on Stack Overflow can, in any way, expose your real identity. If it can, you really have to explain how.
    – Shadow The Spring Wizard
    Sep 20, 2022 at 11:26
  • @ShadowTheKidWizard because some people here post their computer logs, computer details, software, timezone, even accidentally disclosing IP. Also this site database with user data can leak, also in the age of surveillance the enormous data are collected about internet user behavior patterns (URL visited, timestamps, user agents, IPs) - thanks to trackers (which this site is also having embedded), thanks to browser extensions, internet surveillance etc.. Details: youtube.com/watch?v=1nvYGi7-Lxo . There is MANY reasons why privacy should be default.
    – 16851556
    Sep 21, 2022 at 11:10
  • 1
    With all due respect, if someone is posting their computer logs and they care about their privacy, it's trivial they must remove any detail that can identify them. Not doing so makes it their own mistake, they can't expect the platform to fix/undo their mistake. SE actually does support fixing such mistakes, aka "revision redaction".
    – Shadow The Spring Wizard
    Sep 21, 2022 at 11:17
  • 1
    While privacy is important, note that users can just remove their user ID manually from the sharing URL before posting it.
    – Meta Andrew T.
    Nov 3, 2022 at 15:50
  • It should be private by default, not other way.
    – 16851556
    Nov 4, 2022 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .