Are Private Messages (PM’s) on LEC really private?

[inkitin]

The other day, a friend of mine mentioned to me that there were doubts being expressed, on some other forums, as to whether all forum PM facilities are actually fully private between senders and recipients. The inference being that, on some forums, Mods/Admins/others may be able to access members’ PM boxes and read their messages.

Could one of the Management Team please comment on the possibility of this happening on LEC?

[Enright]

Um, well I wouldn't class myself as "the management, Ron" (yes I know it's Roland really - that's just one for those of you who remember Hale and Pace!), but as a moderator I'm more than happy to confirm that not only can we NOT see/read PM's, but we wouldn't even want to.

I was offered the position of moderator because of the ongoing contribution I was making to events, and my enthusiasm for the marque. Oh and possibly my almost OCD like levels of housekeeping (although bearing in mind the state of the garage and plethora of Elan bits lurking about the kitchen, Lisa would argue that last point)! That hasn't changed - in other words we're just like all the other frequent posters out there, albeit armed with a few extra tools which we TRY to use for the greater good. It honestly doesn't include snooping or abuse of power - I don't think it ever has.

Decisions which affect the forum and/or users aren't taken lightly or unilaterally. We do chat to one another and share information or bounce ideas off each other if necessary - let's face it, it's only human to talk to one another. And I'd rather KNOW I was doing the right thing than risk doing the wrong one. However if anyone were to ask me to keep a forum related conversation in confidence - I would, and in fact I have.

I hope that allays your fears on the subject.

[Specky]

Here's a bit of good house keeping, it'll make you cautious thou.

Here's an example:-

I send out a PM to 30 odd people, when you reply make sure you reply to just me and not the thirty odd people I sent the PM to.

I think that makes sense.

it happens quite a bit when I do group buys etc...

TTFN

[ailwyn]

There is, I believe, some forum software that does allow admin/mods to view pms.

This software, as far as I am aware, does not provide such a facility.

One thing to keep in mind is that all forum software does is update a database. With access to the database you could in theory retrieve the pms.

I would suggest that you treat forums in general the same way you'd treat any other repository that is outside of your control, if you don't want people to be able to see it......

Same applies to emails, websites, etc....

Oi, Al, find out what dodgy dealings Roland has been up to and let me know

[inkitin]

Thanks guys, I'm reassured.

Oi, Al, find out what dodgy dealings Roland has been up to and let me know

Yeah, let me know as well Al, I quite fancy being a "dodgy dealer"

[maz_r]

There are 2 sides to this (aren't there always?).

1) Can a PM be read by someone with the correct privileges to the underlying database that drives the forum? Yes. There are additional software modules which allow an admin to view/delete PMs. I don't know whether that software is installed on this board, but I very much doubt it.

2) Would anyone read other peoples PMs? No. Remember that both you and the Admins are required to comply with the law. You agree when signing up that "You agree not to post any abusive, obscene, vulgar, slanderous, hateful, threatening, sexually-orientated or any other material that may violate any laws be it of your country, the country where “Lotus Elan Central” is hosted or International Law.". This would include PMs, I would suggest. The Admins/Moderators are required to comply with the law too. The UN Universal Declaration of Human Rights (in article 12) says "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."

This all goes by the board, of course, if a law enforcement agency were to come and request that LEC divulge the contents of PMs... If in doubt, don't put something in a PM!

Finally, as Neil says, why would anyone look at the content? Just because one could, doesn't mean that one does. Trust the Mods to do the right thing.

I'll shut up now.....

[rip]

Here's another scenario though:
The forum crashes & has to be restored from the last backup. We all expect somebody will be able to restore it. There has to be a way of getting to the data in order to restore it. This often requires an account with priviledges above that of an ordinary admin.

I looked after about 180 users & as an admin, could access their data & e-mail. I would only do this by request from a user or their line manager & they had to have a good reason to request it too. Systems can be set up to audit access, so anything unusual would be recorded. Our system even logged the backup account logging on to each mailbox in order to back it up & threw that up as a security warning.

Snooping through somebody else's crap was the last thing I could be bothered to do. LEC has a lot more users than the system I looked after & it is a voluntary organisation, not a multi-million pound business.

I think it is very safe to say that your PMs are & will remain private. Even so, I would not use them for anything slanderous.

[Sy V]

"Are Private Messages (PM’s) on LEC really private?"

Could one of the Management Team please comment on the possibility of this happening on LEC?

Roland

The straight (no frills) answer is, yes. If that's sufficient then you need not read the rest of this post.
However, the more cynical members may say, "Well he would say that, wouldn't he".
So I offer further explanation.
I am not aware of any method on our set-up that would allow either Doug, Nige or I the ability to read other's PM. It follows therefore that none of the Moderators could read PMs either. If there is a phpBB add-on I am not aware of it. If we (the Admins) were ever to be made aware of such behaviour amongst the Mods I can assure you that the culprit would be excluded with immediate effect.
We (The Admins) have the highest level of privileges amongst the Management Team, although our individual IT skill levels may vary. I still believe that neither of us would be able to infiltrate the system. I cannot comment on the recovery procedure if/when the DB crashes but I trust the personal integrity of the IT support team implicitly.
As a final attempt to put this theory to bed, I will attach a screen grab of the PM section of the Administrative Control Panel. Please note the distinct lack of a "Let the fascist b*st*rds read everyone's PMs" option.

ScreenHunter_01 Oct. 13 08.47.jpg

Please don't ask me about the various settings that you can see... they're either phpBB defaults or what IT recommend.
I hope this all helps...

Sy

[rip]

"Let the fascist b*st*rds read everyone's PMs"

[ashm]

Having operated several different pieces of forum software over the years, I haven't yet come across any which provided an inbuilt facility for admins to read other users' pms. However, admins certainly do have the necessary system permissions to do so; if there's a patch to provide this function (or someone edits the software scripts to implement it) then it would certainly be possible, and in most cases quite simple for someone with basic web programming skills.
However, I doubt anybody would bother to do this as the webserver admin would also be able to browse the back-end database records and that's where the pms are stored. They're probably stored in plaintext too - they weren't encrypted on any of the systems I checked. So the answer is really:
- Anyone who can edit/patch the software can theoretically access pms (probably). But they won't.
- Whoever has admin rights on the webserver can almost certainly access pms with a few mouse clicks.
- The admins working for the company that hosts the webserver (dreamhost.com in this case) certainly have the permissions, computing resources and technical knowledge to read anything on it if they want to, which they won't.

In reality, I very much doubt anyone would be interested. It's possibly illegal (see above), probably immoral and almost certainly very, very boring. It's all basically down to how much you trust the sysadmins to be honest and competent.
I don't mind putting my bank details in a LEC pm, but I don't put them in emails if I can help it. I wouldn't organise anything illegal or potentially embarrassing in a pm though... (not that I do that anywhere else either!)

Adam

[Sy V]

... - Whoever has admin rights on the webserver can almost certainly access pms with a few mouse clicks...

I reiterate, I can't.

[dapinky]

Suffice to say, I spend a lot of my work time "hacking" into peoples "private" systems to see what is going on...........

.....it CAN be done, but as i know what my budget is at work for the necessary processing power, storage and software, i don't believe that LEC will be doing it! In order to maintain a free forum, supported by generous contributions, i can't see anyone being prepared to sanction £100K for a system just so i can see if you don't like me, or think that my way of changing a brake pad could be made easier.

There is so much 'open source' information out there, that snooping on a PM is not only likely to be boring, but far harder than it would be for me to get into your e-mail accounts, or other 'private' information which is freely available to anyone who knows where to look.


Now you're all getting paranoid, remember, "Who's watching the watchers?".

[Dave Eds]

Save your £100k Pinky - I don't like you!