8

SO.ja allows "Post as a guest" and in some cases using the same email address, but it's recorded as a different account.

We need to repeatedly comment on how to merge accounts. Is this behavior correct?

Bug report on SO.ja meta

Update:

I understand how cookies work, but why ask guest users to enter their email address? If you don't use it to identify users, don't need an email address?

In some cases, accidentally created a second (or third!) account in less than 30 minutes.

4
  • 3
    Doesn't posting as guest create a cookie-based account? As long as the cookie is around creating a real account will merge. But if the cookie got lost (different browser, different computer, security settings) a new cookie account is created.
    – rene
    Feb 5 '20 at 8:03
  • When "posts as guests", email address required. Does entering an email address identify the guest user only by cookies? How do I use a "cookie-based account"?
    – cubick
    Feb 6 '20 at 0:52
  • You use a cookie-based account by keeping the cookie alive. That is best done by always using the same browser and that browser shouldn't be too concerned about your privacy / cleaning up on closing a session.
    – rene
    Feb 6 '20 at 7:04
  • 5
    @rene Then why the email address is required to post as guests? Can't we alert if the address is already used when registering a new account? We, SOja users, spend a lot of time to let guests merge accounts.
    – nekketsuuu
    Feb 10 '20 at 23:26
4
+25

Because unregistered users have not verified the email address they have entered, we cannot perform merges of those accounts until they have verified they own the email. Instead of using a credential, they use a cookie to stay attached to the account. Once they've lost that cookie, we can't determine who they are anymore and they'll either create another unregistered account or register it properly.

Just merging subsequent accounts that enter the same email address opens a potential privacy violation. It would allow anyone who knows the email to hijack any unregistered accounts which may have used it in the past. So we're very limited in what we can do with unregistered accounts until we get a user that verifies ownership of the email.

Rather, that email is used as a path to registration. We send an automated email shortly after posting as a guest suggesting that they register the account to keep access to it. The email can also be used to recover unregistered accounts later on, if they decide to register but do so after they've already lost access via the cookie.

1
  • Another problem is that, for example outlook, has a built in browser these days. That would make clicking that link pointless I guess, as you use a different browser at that point, and hence don't use the cookie.
    – Luuklag
    Jun 17 at 15:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .