Can Boards please confirm if there was a data breach in users email addresses being publicly exposed on the website? I have seen a post where a user has mentioned that they were able to see another users email address on their profile.
Cheers!
It looks like some users ticked the box mistakenly believing it would hide their email? Or a bug?
I just took 5 random users from here and can see the email address for all 5 from a simple Google search.
Then I checked yours Leg End Reject an your email is not displayed.
Hang on how do I know if this is possible? I set my profile to private as soon as I realised I needed to on the new side.
as an aside wtf is going on with that image? It’s illegible
@Boards.ie: GDPR look at this
Oh dear oh dear.
What an absolute fu3k up. Boards in big, big trouble here.
@Shield I don't know what terms you're using to search. Can you see my email? It's a burner and non-identifiable so not an issue for me, but is for anyone who's email contains their real name.
It can seen by a simple Google search when I’m signed out. I’ll use an existing example. I should not be able to see this because it’s in a different browser that I never use for Boards, thus I’m not a “member”…
@Boards.ie: Niamh and @Boards.ie: Mark and @Boards.ie: Odhran it looks like we have a data leak. I can see this SIGNED OUT!
Well, the option is clearly there to let others see it. It was in the old websit too. I've never seen people who enabled it for everyone to see but I never went looking on Google.
However, if this option was enabled by default and their email addresses were made visible then that's a big problem. Mine was disabled by default.
<snip>
Found these in 5 seconds using google
@Leg End Reject If ^ that is the case, I wouldn't put it past google that the info was already seized upon and harvested ...Since google instantly harvests every open and available speck of data it can, then posts it openly (as they do with every post, image, avatar etc associated with our username). It would seem safest just to close accounts altogether.
I do wish we had the option to delete pms, given such unforeseen breaches of privacy, but this site doesn't even give us that option (except to lol, "leave the conversation" which isnt the same - the data remains.)
Very honest of you @Shield.
I wasn't aware of the email issue until today. I did see personal information on the now removed Activities page as it wasn't obvious it was public. I PMed one user to tell them and also one of the Boards employees so that it could be removed.
The activities page was pointless, no one needs to know if someone moves up a level based on their post count, or if someone changes their avatar.
I suppose I should clarify that I was talking about being able to see them as a feature as opposed to through a bug. Either way, I've never seen anyone's email address before or after the migration.
I believe in full transparency, now more than ever. It’s the only way our users will trust us. On July 15th, I was able to view the email address of a Boards user who had just been banned. Instead of going to see who else’s email address I could potentially view, I immediately sent a PM to Mark, and he immediately acted upon my report. CC @Mickeroo as the admin who acted upon the report along with @Fr_Dougal and @ReginaldSmythV and @Leg End Reject as and @Signore Fancy Pants as complainants.
...
https://www.boards.ie/discussion/2058199626/has-the-1-week-downtime-move-to-vanilla-killed-this-place/p10
What's the name of that AH thread?
Just read the thread.
Locking up that tread @Fr_Dougal was a load of bollox by @Mickeroo. The whole premise of the thread was to get Boards to clear up the uncertainty surrounding the issue for some users.
Given the condition the site is in (and was in), it was a very valid and pertinent question. The answer of which would have gone a long way to alleviate any user concerns, @Mickeroo has undermined that and made it look like there's something to hide.
Locking it up while accusing the OP of scaremongering and demanding proof from the OP is ridiculous. The OP had no proof, hence he was requesting Boards input, ridiculous call by @Mickeroo.
People have lost faith in this place, locking threads with genuine queries under the guise of trouble making doesn't help @Mickeroo
It remains a valid and unanswered question, was there a time when email addresses were default accessible to all?
If not, then great but don't dissmiss the query and lock the thread because you don't have an answer.
There's been no evidence put forward that has actually happened to anyone so at the moment this is just unnecessary scaremongering. If you find some evidence, PM it to me and I will open the thread again.
and if it was enabled by default on some profiles?
But you’ve zero proof?
it’s an opt in to display your email
Given the absolute mess the site is in, it would not surprise me if there was a window during development that email addresses were exposed.
That's exactly why I'm not on Twitter or Facebook!
In fairness the whole new set up of boards has been an absolute mess with bugs everywhere for some people.
In some cases this box might have been actived by mistake for people or they clicked it by mistake been unfamiliar with new layout.
Nowhere was it explained to people with change over that they now need to be careful that their email address wasn't open for everyone to see!
Thanks for your help, Jeff I changed it to private following your steps so I know now I'm sorted!
With respect, you don’t know what you’re talking about.
Your profile is set to private and not viewable by anyone. Your email address is only viewable to you when you look at your own profile, not viewable to others, unless you choose to make it visible by ticking the box
It just comes up as no permission to see profile.
My email address is identifiable to me.
I used it because when I signed up with boards originally my email address wasn't up there in public, only held by administrators which is grand.
However it is actual a GDPR breach if the conditions are changed from what you originally signed up to and exposing your email address for everyone to see on boards it a GDPR breach and not what I originally signed up for!
You are meant to be notified if your personal information is going to be storaged differently in anyway and I got no notification from boards!
I'm looking into reporting this data breach although if country outside EU I don't know if data commissioner can do anything but I'll enquire anyway.
On my profile, it is an opt in box, not an opt out. Its a burner account so doesnt matter.
Right Jeffkenna, I think mine is ok but would you mind trying to look at my profile to see if you can see my email + please let me know!
This really is disgraceful. Thanks.
