8

How can we persuade edit reviewers to reject substantial edits made from new accounts that seem to belong to the OP?

Case in mind: Recommendations of relevant subjects for penetration testing?

Edit by Recusiwe was approved 2 to 1.

The problem is clear: the OP can edit at will, but does not gain rep points from approved edits. While posting from a new account s/he gains rep that may be accumulated high enough to game the system. How to make this clear to reviewers?

7
  • Nice catch in the fact that it kept scope the same. That's a pretty clear flag that it's the same person on another account. Other "bad edits" to look out for?: - short edits of one or two words that don't clarify anything(synonyms) - edits that change wording, but don't affect scope(1st stays first, doesn't become generalized to 3rd) - speaker expands on the answer in a way that should have only been able to be done by the asker(talking about views or feelings or intent) Anything else I'm missing?
    – Robert Mennell
    Oct 22, 2015 at 15:23
  • 1
    I'm not understanding how this is a problem. Why would rep gain from editing your own posts with a second account cause a problem that editing other users posts with that second account wouldn't?
    – Xander
    Oct 23, 2015 at 13:01
  • @Xander - minor self-edits from a second account may have a higher probability of being approved, which I highlighted in the linked example.
    – Deer Hunter
    Oct 23, 2015 at 14:37
  • 1
    Without statistics, that doesn't seem likely to me. There are already a huge number of existing posts that could arguably benefit from minor edits. Even if there were a higher likelihood that self-edits would be more likely to be approved, and I don't know that I believe that quite yet, it seems the extra effort would be more than negate the advantage, given that one could far more easily suggest many edits on many existing posts by others.
    – Xander
    Oct 23, 2015 at 14:43
  • @Xander - will have a look at the data. I came across this on two sites in as many days. May be a fluke, though.
    – Deer Hunter
    Oct 23, 2015 at 14:50
  • 1
    And to be clear, I'm not disputing that it happens...I generally chalk it up to new users forgetting their credentials and creating a new account though. I'm just trying to figure out if there's really a problem worth tackling in this specific scenario, and I don't see a vector for abuse yet. At least not one that's worse than users making useless edits on other's posts to try and gain rep, which has clearly been a problem (cluttering up the active questions screen) from time to time.
    – Xander
    Oct 23, 2015 at 14:58
  • 1
    Interesting - just stumbled on this meta.security.stackexchange.com/questions/1409/…
    – Neil Smithline
    Nov 1, 2015 at 2:43

4 Answers 4

Reset to default
7

You just made the first step, and hopefully, our reviewers also read our meta.

Agreed, suggesting edits from same person accounts could be used to gain site reputation (say, only 10 reputation points are needed to remove new user restrictions, i.e. only 5 suggested edits which, if they were made on same user contributions, the same user can approve from that other account), and it gets worse in that the standard query that Stack Exchange stuff run when asked to merge accounts doesn't invalidate any reputation gain by suggesting edits on own contents (I tested that). So there's good reasons to be cautious.

Here's a couple of things to do when you suspect, for any reason, that two accounts are of the same person:

  • Reject suggested edit, mentioning in the reason for rejection that the person suggesting it can edit with original account, and if they can't access their contents with their old account (happens, many first post some question or answer from one computer, then register from another), request via flags, in chat,... that accounts are merged.
  • Stop by in our chat room and ping one of our moderators with request that accounts be looked into and merge requested (mods can't do that but we have a simple enough request form to fill for that), if warranted. You may also want to raise a custom flag for moderator attention on the post itself and explain what you suspect is going on.
  • See if the post needs editing anyway, and if it does, hit the reject and edit button, edit and submit so the suggested edit review queue is cleared of that item and isn't later approved by next two reviewers that missed this, erm, user correlation, let's put it mildly.
4

While you are a MOSSAD secret agent able to know that two or more accounts belong to the same user, not all members have that paranormal power nature provided you. I accepted that edit suggestion because it makes a sens and I do not have your super powers to guess among the thousands of users who is who and how many accounts has each member.

Just yesterday an other user complained here about me rejecting his edit while I was suspended for a week for editing only in the purpose of fixing spelling errors, and in the same time, I see many weird accepted edits such as this one I rejected.

It is true, we need to pay more attention for edit suggestions but we can not be perfect.

1
  • 2
    Ouch! You blew my cover!
    – Deer Hunter
    Oct 22, 2015 at 7:06
4

Reputation gains from edits work only up to 2000 rep. An industrious user may pull it off once or twice (subject to actually doing 1000 edits, that all get accepted -- this is hard work), but repeated merges with accounts at 2000 rep ought to attract some attention. This is low-grade gaming. I don't see it as a major threat.

1
  • 2
    It's not a threat per se, just a potential security vulnerability for spammers. An extensive voting ring with a highly irregular voting graph may fall between the cracks of SE's automatic detection routine.
    – Deer Hunter
    Oct 23, 2015 at 20:29
4

In my opinion, new users aren't gaming the system. Instead, they are confused by the multiple login options provided... perhaps they are at a different computer and log in using FB on one, and Google on the other.

I know from personal experience that it's a pain to authorize a new workstation if multifactor and other security controls are set up. Furthermore, SMS validation (Facebook, Google) for those instances where someone must "save a browser" is only possible when cellular coverage is available. For users overseas, it's very possible that SMS isn't as available as urban folk may take for granted.

Finally, many Facebook app developers are required to use multifactor security, as the enhanced "privacy dinosaur" app-checklist forces all developers to configure their accounts for such security.

So, yea, they are new to SO and it's more of a "HRD" (home realm discovery) issue than anything else.

1
  • +1. Looks like a Stack Exchange usability issue to me.
    – Deer Hunter
    Oct 24, 2015 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .