I think it's beneficial to prevent social engineering attacks based on content our users post in this site.

One example of the problem is responses to this question, where users are asked about their current environment. Subsequently, users may have information in the Bio section that will identify their employers or the projects they are working on. This disclosure may be in volation of thier IT policy, and may be a risk in some situations..

With those goals in mind, I think it's a good idea to consider more security features on the user profile page (such as redaction), or the ability to post anonymous questions and answers.

I would even go so far and recommend that users use a different OpenID when using this site until we find a solution.

So based on that...

  1. What are you thoughts on importance of this issue?
  2. How can we make things better?

4 Answers 4


Yes, this is a very good point to raise, note that a similar issue was discussed here - though that was about the FAQ.
It might be a bit paranoid, but then that's to be expected here, no?

While I do think it is important, I also think everybody here can be responsible enough to not post really sensitive information in public. Perhaps a reminder, put it in the FAQ, maybe 3 1/2 words in our blurb, possibly even a banner for new users or once in a while...

That said, I do think it might be a good idea to propose to @Jeff Atwood and the team... I dont think redaction could work well, but supporting anonymous posts might be worth doing (although not trivial).

Also, it occurs to me that there is a great place to get more ideas from the best security pros, if you can generalize the question. Who knows what we'll come up with, they'd probably appreciate having the community come up with security solutions for them :D

  • I do agree that self-moderation is key, along with the tools that are used to protect the poster. Along those lines, anonomizing select posts will build a better community than communing with overly-anonymous users. Not to mention having the sense that one is communicating with an 'expert' in the field will benefit everyone involved. If there is a programatic solution, I'm all for it. Commented Nov 23, 2010 at 22:25
  • I think extending the idea of "community wiki", and making it possible to have completely anonymous posts (goes without saying pointsless and awardless) could be worked into something very useful.
    – AviD Mod
    Commented Nov 23, 2010 at 22:44
  • Sounds like a good approach! Commented Nov 24, 2010 at 1:11

Just use your secondary browser, you know the one without persistant store, and post as if you had no account on security.stackexchange.com.

Don't work for meta aparently...

trying of the main site attempting to post sends me to


which states simply 'Oh tin of pink meat / I ponder what you may be / Snout or ear or feet?'

I wonder what is the minimal set of things I need to turn on to get past that...


As we have the question about APT SIEM, I think we should definitely allow anonymous postings - I am interested if anyone can say anything here without risking themselves. However, as folks pointed out, everyone may be under NDA's so this may not work.

Anonymous postings really only help when people want to post something which may heighten their risk, not to help someone breach NDA without discovery.

  • FWIW, it's not illegal to violate NDA anyway, it's just a breach of contract (although you might be liable for damages if they can be proven). If someone is going to break NDA, let them break it. Let whoever hired them be free to fire them for it as well. I don't think SE should be in charge of policing private contracts, unless such a violation would break the law. Not to mention, often NDAs themselves are just there to prevent people from hinting at the fact that their company is breaking the law (e.g. not conforming to regulations). Now, leaking classified information on the other hand...
    – forest
    Commented Mar 12, 2018 at 8:03
  • I completely agree @forest
    – Rory Alsop Mod
    Commented Mar 12, 2018 at 15:45

I think anonymous posting is too extreme, but maybe I'm reading the question to narrowly.

Are you suggesting anonymous as in not logging in, or log in and post anonymously?

The second is the only one that makes sense for being able to give feedback (and also prevent abuse). It would make sense to generate a one-time username that is associated with the question that you can access via your main account. That way you can log into your normal account, and have your "anon" questions visible (only visible to you but not publicly linked to your account). This would require you to trust the site admins (and possibly moderators).

For partial anonymity, I think most people will be fine with pseudonyms. Create another ID and use that for sensitive stuff.

For full anonymity, the truly paranoid would need to compartmentalize their questions across many openIDs to reduce the information leakage across multiple questions. I don't think this is too much of a burden for the few people that need it. The people with the greatest security needs should pay the most.

If a large number of people really need anonymity, then I think we should come back and think about changing this core principle of identities.

  • I agree. The community is supposed to be self-moderating, so we should trust users to decide what they do or do not wish to say here.
    – user185
    Commented Dec 9, 2010 at 9:07
  • 1
    The problem comes when they want to say something, in order to get the answer they need, but shouldnt say it publicly. To some extent this might be true on other sites, but especially here Security issues can be highly sensitive - but what ya gonna do if ya need an answer?
    – AviD Mod
    Commented Dec 9, 2010 at 10:33
  • @AviD: I agree with you. I just don't know if the use-case warrants adding functionality, when people can create a new openID and post using a pseudonym. If it is a common use-case, then I think we can come back and find the best compromise between security/paranoia and features. Commented Dec 9, 2010 at 22:06
  • Pseudoanonymous ought to be fairly straight forward for posters and the posters subsequent comments... Just hide the posters name etc in the record...everything else works as normal...
    – Andy Boura
    Commented Aug 4, 2014 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .