Should we support anonymous postings?

Question

I think it's beneficial to prevent social engineering attacks based on content our users post in this site.

One example of the problem is responses to this question, where users are asked about their current environment. Subsequently, users may have information in the Bio section that will identify their employers or the projects they are working on. This disclosure may be in volation of thier IT policy, and may be a risk in some situations..

With those goals in mind, I think it's a good idea to consider more security features on the user profile page (such as redaction), or the ability to post anonymous questions and answers.

I would even go so far and recommend that users use a different OpenID when using this site until we find a solution.

So based on that...

1. What are you thoughts on importance of this issue?
2. How can we make things better?

Answer 1

Yes, this is a very good point to raise, note that a similar issue was discussed here - though that was about the FAQ.
It might be a bit paranoid, but then that's to be expected here, no?

While I do think it is important, I also think everybody here can be responsible enough to not post really sensitive information in public. Perhaps a reminder, put it in the FAQ, maybe 3 1/2 words in our blurb, possibly even a banner for new users or once in a while...

That said, I do think it might be a good idea to propose to @Jeff Atwood and the team... I dont think redaction could work well, but supporting anonymous posts might be worth doing (although not trivial).

Also, it occurs to me that there is a great place to get more ideas from the best security pros, if you can generalize the question. Who knows what we'll come up with, they'd probably appreciate having the community come up with security solutions for them :D

Answer 2

Just use your secondary browser, you know the one without persistant store, and post as if you had no account on security.stackexchange.com.

Don't work for meta aparently...

trying of the main site attempting to post sends me to

https://security.stackexchange.com/questions/ask/submit

which states simply 'Oh tin of pink meat / I ponder what you may be / Snout or ear or feet?'

I wonder what is the minimal set of things I need to turn on to get past that...

Answer 3

As we have the question about APT SIEM, I think we should definitely allow anonymous postings - I am interested if anyone can say anything here without risking themselves. However, as folks pointed out, everyone may be under NDA's so this may not work.

Anonymous postings really only help when people want to post something which may heighten their risk, not to help someone breach NDA without discovery.

Answer 4

I think anonymous posting is too extreme, but maybe I'm reading the question to narrowly.

Are you suggesting anonymous as in not logging in, or log in and post anonymously?

The second is the only one that makes sense for being able to give feedback (and also prevent abuse). It would make sense to generate a one-time username that is associated with the question that you can access via your main account. That way you can log into your normal account, and have your "anon" questions visible (only visible to you but not publicly linked to your account). This would require you to trust the site admins (and possibly moderators).

For partial anonymity, I think most people will be fine with pseudonyms. Create another ID and use that for sensitive stuff.

For full anonymity, the truly paranoid would need to compartmentalize their questions across many openIDs to reduce the information leakage across multiple questions. I don't think this is too much of a burden for the few people that need it. The people with the greatest security needs should pay the most.

If a large number of people really need anonymity, then I think we should come back and think about changing this core principle of identities.