53

There is a tool available to moderators that can show up to 1000 email addresses at once with a single query. On smaller sites, this tool is probably powerful enough to create a dump of the email addresses for a large part of the userbase with two dozen queries. And probably an almost full list of emails with a few hundred queries. I didn't run into any draconian rate limit on this tool so far, so I'm not sure what limits exist.

There are legitimate uses for this tool, but they don't require it to be as powerful as it is right now. A few tweaks would make this tool far, far harder to misuse for dumping large amounts of email addresses, returning far fewer results and limiting the minimum character count for queries would not affect the legitimate uses of this tool at all in my opinion. These tweaks would also make rate limits and alerts effective in stopping and detecting misuse of this tool.

We moderators aren't inherently trustworthy; in the end we're just random people on the internet. The tools that allow us to see PII should only be as powerful as necessary, and not more. And this tool is certainly far more powerful than it should be.

This tool might be even more problematic in combination with SO Teams, but as I'm not an SO mod I can't be fully sure about how all the tools interact with Teams (see my previous MSO post about that aspect).

Improve this question
11
  • 13
    Is running the query logged? Can SE staff audit its use? IIRC the PII on a userprofile is behind a button so clicking the button is recorded.
    – rene
    Dec 30, 2019 at 16:25
  • 16
    Out of curiosity, why was this posted here instead of the Mod Team, where I believe (IIRC) that it was decided that posts like this about the more secret mod tools would go?
    – Mithical
    Dec 31, 2019 at 12:45
  • 12
    Please don't break this - it's not something that's often needed, but when it is needed it's extremely helpful in dealing with some of the most abusive and troublesome users on SO. Happy to elaborate in private some examples of things that are useful to do with it, but I don't think MSE is the right place to document that. Auditing usage like other PII access would be a much better solution.
    – Flexo
    Dec 31, 2019 at 15:42
  • 11
    @Mithical Because it's a basic privacy issue that impacts every single user on this site, not just moderators. Your comment reads as basically "how come you told the plebs we all can see their email addresses?" If there's truly no problem with this tool, then there shouldn't be a problem discussing it publicly with the people whose information is visible through it.
    – Zach Lipton
    Jan 1, 2020 at 0:10
  • 13
    @ZachLipton, it is well known that the mod toolkit consists of access to PII, so your analysis of Mithical's comment isn't accurate. The problem starts when this information falls into the hands of users who trying to cheat, who then take a different path while cheating, which would make it harder for moderators to detect. Ultimately it is the users who are at the receiving end as the cheaters can get away with artificially inflated reputation for a longer time. To put it in a different way, keeping the knowledge about certain moderator tools private helps the users more than them knowing it.
    – Bhargav Rao
    Jan 1, 2020 at 1:44
  • 9
    You want to keep information about the use of my personal information secret, or at least not well-known, out of some sort of sense of paternalism where you claim that it's actually better for me if I don't know about it because of some other people who cheat. That comes across as incredibly disrespectful and is not part of the spirit of trust and transparency with which I'd hope my personal information is treated. Why should I trust you with any of my information if you're going to argue that it's better if I don't know what's being done with it?
    – Zach Lipton
    Jan 1, 2020 at 1:51
  • 3
    @BhargavRao It may be well known among mods that you have access to PII, but I certainly didn't know it, Zach Lipton didn't and I don't think most of the SE/SO users know about it.
    – Astrid_Redfern
    Jan 1, 2020 at 14:15
  • 8
    @Astrid_Redfern FWIW that info has been on meta since (at least) 2012 meta.stackexchange.com/a/149637/401104
    – Em C
    Jan 1, 2020 at 15:46
  • 2
    I'm voting to close this question as off-topic because it contains part of the secret sauce recipe of moderating.
    – StrongBad
    Jan 3, 2020 at 22:00
  • 3
    I'm voting to close this question should be asked on Teams instead.
    – Rubiksmoose
    Jan 3, 2020 at 22:05
  • 6
    @StrongBad: Any sock-puppeteer without the wit to use unrelated e-mails for their sock-puppet accounts is unlikely to be the kind to scour Meta SE for leaked secrets.
    – Scortchi - Reinstate Monica
    Jan 3, 2020 at 22:56

4 Answers 4

Reset to default
21
+500

Thanks for your feedback.

We moderators aren't inherently trustworthy; in the end we're just random people on the internet.

I would like to respectfully disagree. While you are all indeed people on the Internet, you are not random. Moderators are elected to positions of trust by their Communities, and sign agreements that define the permissible uses of PII. It is true that a bad actor could use this tool in an abusive manner. But that is true of many more of the tools that we extend to our trusted moderators. We trust our moderators to use all of these tools responsibly and in accordance with the moderator agreements.

In addition to this, we have received significant feedback from moderators that the tool with its current capabilities is being used effectively. So because of all this, for the time being, the tool will stay as is.

That being said, I have spoken with our InfoSec department about your concerns. They approve of this response, but are also going to continue to examine this tool (and others), and could make adjustments in the future based on their findings.

Improve this answer
3
  • 2
    "We trust our moderators to use all of these tools responsibly" - from a business perspective, the question is, do you trust these people with €20m? Because that's the maximum GDPR fine for SE if one of the mods decides to extract and dump user data of EU users...
    – l4mpi
    Feb 28, 2020 at 11:24
  • Thank you for providing an official response here. I’m not convinced though by this argument on trusting mods. While it is rare, there have been several cases of moderators acting in ways that forced SE to remove their diamonds to prevent misuse or further harm. The community can judge how a candidate behaves themselves on the site, but otherwise we often know almost nothing about the potential moderators. There is at least one former mod that is a convicted criminal.
    – Mad Scientist
    Feb 28, 2020 at 19:01
  • @MasScientist thanks. I wanted to get you an official response, so that there is not the perception that we are ignoring this. That said, this is an area (this tool and other related functions) that is going to be getting additional scrutiny pretty soon, so there is a possibility for further adjustments in the future.
    – Yaakov Ellis StaffMod
    Feb 29, 2020 at 22:12
41

Please, do not break this tool. I use it all the time because it is the only tool that lets me find users by patterns.

I can’t count the number of sock networks I’ve cracked wide open with this tool. I also have a few persistent question ban evasion users on my naughty list that I keep under control because they happen to stick to patterns I can find with that tool.

If anything I have a wish list for more powerful pattern query options, because I often can’t narrow down the list of matches enough to be useful.

Is there a way we can retain this use case please?

Improve this answer
12
  • 13
    I'm in the same boat. I use this tool all the time to keep on top of a list of persist abusive users, and to uncover networks of stock puppets.
    – user229044
    Dec 31, 2019 at 21:35
  • 9
    What is needed is a server side tool that does those checks automatically and without direct access to the data being given to moderators. The fact it's handy to you does not make you having that access appropriate (and it's doubtful legality that you have that access IMO).
    – StephenG - Help Ukraine
    Dec 31, 2019 at 21:46
  • 22
    @StephenG I can’t see this automated, sorry. It’s not like every sock network uses the same patterns or that they even stick to their patterns consistently, and there are plenty of false positives in there that I as a human can weed out. I’m bound by the moderator agreement to protect the PII I have access to, by the way.
    – Martijn Pieters
    Dec 31, 2019 at 22:04
  • 1
    @JourneymanGeek yes, I understand it's usefulness in uncovering "linked" accounts. The question is: Can this be achieved without exposing the actual IP to the mod.
    – user
    Jan 1, 2020 at 14:18
  • @Fermiparadox: An injective, one-way function of the IP address would certainly help in catching sock-puppets, but on its own would lose additional clues from geolocation or the identification of institutional IPs.
    – Scortchi - Reinstate Monica
    Jan 1, 2020 at 15:28
  • @Scortchi-ReinstateMonica related. Technics do exist that combine more than simply an IP, perhaps without exposing any PII to the investigator. Whether that is true, or if SE has invested into such systems I don't know, but this indicates the tools are rather crude.
    – user
    Jan 1, 2020 at 16:16
  • @Fermiparadox: not really; like in email, there are patterns that I make use of when linking accounts that derive from how IP addresses and networks are related.
    – Martijn Pieters
    Jan 1, 2020 at 21:32
  • 4
    @Fermiparadox until recently - I'm under the impression that a significant number of moderator tools outside very core ones were lightly cleaned up versions of internal tools. There's a few that I can talk about that give and gave me massive headaches in the past. The old version of the synonym tool was a load of 'fun' when you invariably got it wrong, and the initial version of the post redaction tool was something many mods didn't like to use cause it was a little massively intuitive. In the past year, SE's actually improved mod tools a fair bit, and its been a focus
    – Journeyman Geek
    Jan 2, 2020 at 3:44
  • 2
    Maybe some of the patterns could emerge even with hashed content? This is a common problem, cf. the discussion on whether to keep exposing IP addresses of unregistered users in Wikimedia wikis. meta.wikimedia.org/wiki/…
    – Nemo
    Jan 18, 2020 at 13:43
  • 1
    I wonder how many mods already abused this tool. This kind of breaches (that some mods seem to be very interested on keeping "secret") can lead to huge private information leaks. At some point the risk overcomes the usefulness.
    – NPN328
    Feb 21, 2020 at 23:59
  • 2
    @VonHuffman mods (ab)use this all the time, and draw more or less competent conclusions from IPs and email address correlations. It would be trivial to serve them that data hashed / anonymized (which would be just as useful for detecting sockpuppets, but useless for doxxing or "informing" their bigotry), but this whole "trust" privilege bullsh*t is very much part of the design of this site. Just like other gamification features meant to infantilize users and push them into pecking order structures, and away from bothering too much about the accuracy or usefulness of their postings.
    – user421742
    Feb 22, 2020 at 4:10
  • 1
    @mosvy I agree, it's a very valuable tool for mods. It just should not be in a form that has such a big abuse potential, neither should that usefulness be valued over "secret" breaches to private and personal information. Or at the very least make it known that it is not actually private information, like they already do with hidden networks.
    – NPN328
    Feb 22, 2020 at 4:17
6

I never seen such leak to date, and probably as moderator sign a NDA clause and legally it can be a problem if a leak happen under their name.

but.. I think another path exist. It’s not the tool the problem IMO, but what would be nice to protect against, is an account take over, as such could lead to such leak.

To prevent that SE could ask mod for a 2FA authentication when they try to use a powerfull tool that interogate the PII.

That way SE would be sure it’s me that ask info about the PII. It, legally bind myself more to the responsability of the usage of the data as a moderator.

(No one told it too, but does SE enforce strong password too for mod?)

I talk those alternatives, as even if a limit happen, nothing could stop me to make a list anyway, it will just take longer (Only internal CM auditing could break my record).

Improve this answer
3
  • Assuming that 100% of the mods will be 100% honest 100% of the time, you don't need a mod for such a breach, just access to a mod's account, one time. If the tool can't be provided in a way that doesn't breach user's private and personal information, it either shouldn't be provided at all, or information that is not actually private should be clearly labeled as such (as they already do with hidden networks).
    – NPN328
    Feb 22, 2020 at 5:01
  • Not even having a 2FA option for accounts is a bit of a different issue, but also something I consider pretty problematic, especially as it also applies to employee accounts as far as I understand. 2FA should be mandatory for any account with access to PII. The point of limiting the results is not to make it impossible, but to slow it down enough to either be infeasible, or to make it much easier for tools that detect malicious patterns to raise alarms. It's much more difficult to detect an abnormal pattern from 10 requests than from a 1000.
    – Mad Scientist
    Feb 22, 2020 at 8:58
  • @madscientist If you dont trust mod, then remove them access to all PII then.. You talk email, but what about like IP? I could know where you live and possibly where you work if you log from work.. Way more sensible than email IMO
    – yagmoth555
    Feb 22, 2020 at 14:46
6

I personally don't need this at the cryptography site. Maybe we can enable such usage upon request? I'm personally not happy at all if such a list can be downloaded. I would hope that the email addresses can be at least kept within a browser window instead. That makes it less likely that the mail addresses are found on somebodies discarded hard disk.

Please note that sharing such information can go against privacy policies within many countries. It should be checked if the sharing of user data (in such a bulk fashion) doesn't violate local / European laws. This goes of course for all user related data that is shared, but this seems to be a rather special case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .