Meta Stack Exchange is a question and answer site for meta-discussion of the Stack Exchange family of Q&A websites. It only takes a minute to sign up.
Sign up to join this community
SO.ja allows "Post as a guest" and in some cases using the same email address, but it's recorded as a different account.
We need to repeatedly comment on how to merge accounts. Is this behavior correct?
Update:
I understand how cookies work, but why ask guest users to enter their email address? If you don't use it to identify users, don't need an email address?
In some cases, accidentally created a second (or third!) account in less than 30 minutes.
Because unregistered users have not verified the email address they have entered, we cannot perform merges of those accounts until they have verified they own the email. Instead of using a credential, they use a cookie to stay attached to the account. Once they've lost that cookie, we can't determine who they are anymore and they'll either create another unregistered account or register it properly.
Just merging subsequent accounts that enter the same email address opens a potential privacy violation. It would allow anyone who knows the email to hijack any unregistered accounts which may have used it in the past. So we're very limited in what we can do with unregistered accounts until we get a user that verifies ownership of the email.
Rather, that email is used as a path to registration. We send an automated email shortly after posting as a guest suggesting that they register the account to keep access to it. The email can also be used to recover unregistered accounts later on, if they decide to register but do so after they've already lost access via the cookie.
