2

In a previous question, it was asked whether it is possible to authenticate a user through the Stackoverflow API? The short answer was no, not until version 2. Now I would like to know: is there any way we can use in the mean time to validate a user and associate his account on my site with his SE account? I would like to know that when a user on my site claims to own a certain StackExchange account, he really does.

One way I'm thinking of, without authentication, would be something like asking the user to change his bio to include a certain link or keyword - then I know I can associate his account om my website with that SE profile. Not the nicest solution, but it will work. Has anyone tried something similar, or could you suggest a better way of doing it?

Improve this question

2 Answers 2

Reset to default
4

I had a similar issue a few months ago ago, and I came up with a couple of suggestions, one exactly like how you suggested:

  • Ask the user for the email associated with their account, MD5 it, and compare it to the value provided by the API. This works, provided it isn't essential that the user is who he says he is - a users email may be publicly available, after all.

  • As you suggested, ask them to add a randomly generated token to their bio. This is how TF2Lobby did things before Steam added OpenID authentication: you were required to add a string to your profile consisting of tf2lobby:asdf923, where asdf923 is your generated string. This is a surefire way of finding out whether someone is who they say they are - only that user (and mods, I guess) have write access to that user's profile.

Improve this answer
0
2

This is relatively easy - just make him give you the same email address that he provided for his Stack Exchange account and then calculate the MD5 hash of the email address. Then compare that to the email_hash member of his account data.

If the two hashes match, then the user is indeed who they claim to be. If not, they either provided a different email address or they are not who they're claiming to be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .