I opened my Stack Overflow account after almost 18 days today.

I didn't bounty on this question, and what next should I do for security concerns? How can I revoke my points?

  • 14
    The bounty was placed immediately after logging into your account on September 5, so if your account was indeed hacked, it's because they know your password. The only way to resolve that would be to change your password and make sure you keep it more secure. – animuson Sep 15 '20 at 14:56
  • 8
    And change your password everywhere else too. – marcellothearcane Sep 15 '20 at 15:18
  • 6
    I highly recommend locking your computer if you're working in a public space. When using a shared computer, always log out of whatever service you used to sign in (Google / Facebook / etc). Someone getting access to an unlocked logged-in machine is a more common cause of shenanigans than someone getting through the service you use to sign in (especially with two-factor auth enabled). Folks pretty constantly forget to sign out of, say, Facebook when they sign out of SO on a shared machine, not realizing the risk. – Tim Post Sep 15 '20 at 17:29
  • 2
    If it's some small comfort, a user has now been suspended and had several of their fraudulently upvoted posts deleted at least partly as a result of you reporting this. I hope you'll be able to have the bounty refunded as well, but I'm not sure if that's actually possible (moderators aren't able to, at least as far as I know - I'm not sure if CMs can). – Ryan M Sep 16 '20 at 18:58

We see this from time to time. The most likely scenario is you were using the same password as on another site that was hacked and that password was made available on password dumps. Another scenario we've seen is people obtained these e-mails and passwords through a scam.

The latest one that occurred on Sep 5 had e-mails from the accounts involved be in the Have I Been Pwned? database (You can check your own e-mail and password there and verify). We will invalidate credentials as needed when this happens - but what I can recommend is: change your password and do not use the same password on two different sites, make it unique. Otherwise, if one of the sites gets breached, all your accounts that share an e-mail & password are now at risk.

I will be checking with our devs with regards to reversing these bounties from Sep 5 - it's likely we can do it so I'll update here when it's done.

  • Should we really reward people for compromising their account security, and thus the security of the network? – Luuklag Sep 16 '20 at 21:04
  • 13
    @Luuklag I wouldn't qualify giving reputation that's rightfully theirs back to them as rewarding - people make mistakes and it's low-cost for us to revert these. – Cesar M Sep 16 '20 at 21:05
  • That depends on how you value the dev-time it takes to modify the db. I would consider this a cheap lesson for them in securing your account. If SE was a bank OP's problems woupd be far bigger and expensive. – Luuklag Sep 16 '20 at 21:22
  • 6
    Our devs said this is a low-cost fix, not me - sorry if it wasn't clear. Thankfully we're not a bank and no offline-world money was lost, and if even credit cards will chargeback fraudulent purchases, I think we can do it too. – Cesar M Sep 17 '20 at 2:39

The bounty on this question was started by the hacker on September 5th, and has already expired, so you cannot get your points back. I advise changing the password on all your accounts currently using the hacked password, make the new one more secure by adding various special characters, numbers etc., and be sure to keep it safe.

  • While most of us mere mortals can't reverse bounties, mods included, there's actually paths to do this – Aibobot Sep 16 '20 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .