9

Occasionally, there are questions where a poster would like to provide login information to a third-party site in order to better explain their problem.

Sample questions include:

Should login information be allowed in questions or answers? Does it matter if it is a throw-away account? Does it matter if it is not tied to real money?

  • This is supposed to be a site about personal finance. The topic in the two examples given, FOREX option trading, really isn't fodder for a personal finance site anyway. Also: Look at this from the other side: Would you want StackExchange members posting their login information on third party sites to explain a problem with StackExchange? I think a policy of allowing users to do this has infosec and possibly legal ramifications that you don't want to contend with. – Ellie Kesselman Aug 20 '11 at 10:48
9

Ethical and legal issues aside, all relevant text and information should be included in the post whenever possible. This site is supposed to be the canonical source of questions and answers for personal finance. As such, questions and answers should be self-contained as much as possible. External references and links (apart from attribution) should be discouraged.

If a question requires a login to a specific (even demo) account, it is "too localized" by definition. It's bad enough that people link to content which may or may not be there in the years to come, but I can't imagine that a demo account and its data will be preserved for those who come after.

  • 5
    So perhaps, then, providing quoted-text or a screen-shot of the information in the demo account might have more lasting value to the question? – Chris W. Rea Nov 23 '10 at 16:04
  • 1
    @Chris W. Rea: Exactly. – Robert Cartaino Nov 23 '10 at 22:10
11

All login information should be removed from questions. Frequently (if not always), it is against the terms of use for the website linked to. For example, the two questions listed above are from saxobank.com and their terms of use state: "You are responsible for protecting and securing your User Name and password from unauthorized use and disclosure."

Due to our inability to monitor the terms of use for every website linked to, Money.stackexchange.com should not allow the posting of login information to questions.

  • 2
    Yes. There are just way to many potential issues with allowing people to provide login data, even to simulated accounts. – George Marian Nov 19 '10 at 17:09
  • I'm pretty sure those terms of use only apply to live accounts, not demo accounts. Logging into my demo account for the example questions (both mine) provides much more information that I could provide in a post. I don't understand what other issues there are? People could easily create their own demo accounts, but that takes time/effort, and, since I'm asking the question, I want to do as much as possible for any potential answerers. – barrycarter Nov 19 '10 at 17:33
  • 2
    @barrycarter The terms of use I quoted were acquired from the links you gave. My point is that we can't know all of the terms across the web and even the ”demo” account you linked to says it should not be disclosed. I think the best policy is to disallow login information from questions. If you have a solution I encourage you to write a new answer to this question. – Alex B Nov 19 '10 at 23:16
  • 1
    I'm going to nitpick here. The terms forbid unauthorized use. However, I'm authorizing it. It doesn't say I can't tell anyone, just that I have to protect it from people that I don't authorize. I think a blanket ban is a bad idea, and that there's a big difference between demo and live accounts. Example: I'm having an issue w/ a live account + want stackoverflow's help. I simply re-create the problem on my demo account and people can safely help me. The purpose of demo accounts is often to test and get things worked out. – barrycarter Nov 19 '10 at 23:45
  • @barrycarter If you feel strongly that you have a good solution to when it is alright to post login information, please add an answer to the question explaining your point. – Alex B Nov 20 '10 at 2:12
  • @Alex B I agree with you, made a comment on the original question as to why I agree with you. But it seems as though this has been decided by the powers that be. Unfortunate, if that is the case. – Ellie Kesselman Aug 20 '11 at 10:51
2

Login information for demonstration accounts should be permitted in questions.

It's helpful:

% If you're asking questions about a site, letting people visit the site is more effective than any number of words and screenshots.

It's polite:

% When asking a question, you want to do as much for potential answerers as possible. Forcing them to create an account (often requires giving out an email address, which some people dislike) and then configure the account properly (not trivial in many cases) is a lot more work for them than giving them to access to an existing properly-configured account.

It's effective:

% The more work a question requires, the fewer answers it will receive. Filling out a form, waiting for email confirmation, and configuring an account just to start on the problem is a lot of work, and certainly discourages people from casually browsing to see if they can help.

It usually doesn't violate TOS:

% Many websites ask you to insure your account isn't accessed by "unauthorized parties" or that "you are responsible for access to your account". However, posting account information on stackexchange sites means that you are authorizing stackexchange readers to access your account and are accepting responsibility for their access to your account.

It's legal:

% Generally, I can transfer any rights I have under a site's TOS to others. Some sites' TOS forbid transferring access, but these are generally sites that provide access to things of value such as pictures, movies, songs, etc.

It's on-label use:

% Demonstration accounts often exist to help users understand how a site works. Anything that helps the user understand how a site works (or whether to sign up for a real account), including having stackexchange users visit the site and offer their opinions, is a legitimate use of a demonstration account.

It's ethical:

% Since any stackexchange user could get a demonstration account anyway, the site is in no way harmed if someone uses an existing demonstration account. Providing access to an existing account is simply a convenience and a shortcut, not a method of providing illegitimate access.

Of course, the above doesn't apply to all sites. For example, a site that provides demonstration accounts only to people meeting a certain criteria may not want other people accessing the site.

However, the notes above apply to many sites, and a blanket ban would be overkill and do more harm than good.

  • 1
    I'm concerned that it does violate the TOS and you state otherwise above. It's possible that in this case either one of us could be convinced that the other person was right. I'm more concerned about the long-term view. How should we resolve this in a way that scales for future questions? When a new question comes up with a new login/password for a site we haven't been to, how do we know if this is an "ok" site or if this is a login that should be deleted from the question. – Alex B Nov 22 '10 at 5:01
  • 2
    The issues I see comes down to practicality: 1) Who wants to keep track of the sites for which we can allow login data? 2) Most sites reserve the right to change their ToS as they see fit. I for one would not want to have to do cleanup after a site changes their mind and decides to forbid sharing of account information. Another concerns is what Alex B is referring to above: if a site does not explicitly allow or forbid sharing this information, we must make a judgement call. While I am plenty bold and make lots of judgement calls, IANAL and this is an area where I tread with care. – George Marian Nov 22 '10 at 6:10
  • 1
    I don't think it's our problem to police other sites T&Cs, and barrycarter calls out a worthwhile use case where it would be harmful to have a blanket ban. – Ganesh Sittampalam Nov 30 '10 at 13:24
  • Usually, sites like stackexchange are immune from their users' TOS/T&C violations, just like stackexchange would be immune for having copyrighted material posted unless they received a DMCA takedown notice. Although I believe the issue is settled, I still propose allowing password posting, and only removing posts if the site in question complains. A third (icky) alternative: allow people to post passwords, but only after they've obtained permission from the site. – barrycarter Nov 30 '10 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .