How Private Are Private Messages

[Carla]

Can the owner of a forum read private messages among all users, by reading the database directly, bypassing xenforo front end and xenforo security?

 

[Blatchy]

Can the owner of a forum read private messages among all users, by reading the database directly, bypassing xenforo front end and xenforo security?

short answer.. yes (or at least you used to be able to)

 

[M@rc]

Anyone with database access should be able to read private messages since the data is stored there.

You'll need an addon for a UI via xenForo.

There are also some addons I believe that flag private messages with specific keywords and prints them out for staff.

 

[hstammlerj]

Take a look at the wording here in the platform: private messages / PM are called "conversation" consequently. That points into the right meaning of their overall function.

The platform I'm administrating moved from vbulletin to XenForo 1.5 years ago and besides the clear wording difference we also encountered another XenForo specific concept for conversations which you might want to know early enough...

Background:
Beginning a conversation, a person can define if it is allowed to add more participants by every participant any time during the conversation. Additionally, being a "conversation moderator" you may have this "add participant" right even in conversations you aren't the starter and the starter didn't allow initially.

The specialty:
Every participant being added somewhere later during the conversation instantly gets access to the complete conversation thread right back to the beginning of it.

Our outcome:
For us, this behavior was really special and we thoroughly discussed the possible effects reducing the "private" character of a message (that time, being vbulletin users, still calling and "feeling" it being a PM).
In the end we actively decided to keep the original "conversation" wording also in our main platform language (de-de) and not to try to keep calling it a PM for user convenience and "wording backward compatibility".
As effect, there were several user questions and discussions to be supported why the h... private message needed to be renamed to conversation but that didn't take too long. Now, the positive effect of everybody being able to realize that a conversation isn't worded or defined "private" because in the end there are several technical possibilities to break the privacy weighs up our initial support effort.

You'll need an addon for a UI via xenForo.

Or the counterpart:

[BS] High privacy

.features: Disabling IP logging in the entire forum for all users (action logging remains, only the IP field will be empty) Disabling IP logging by user in privacy settings Deleting conversation messages some time after sending Conversation by...

xenforo.com

 

[beerForo]

Take a look at the wording here in the platform: private messages / PM are called "conversation" consequently. That points into the right meaning of their overall function.

The semantics don't really matter. You live on private land and the local park is public land. That doesn't mean nobody can see you.

 

[beerForo]

Can the owner of a forum read private messages among all users, by reading the database directly, bypassing xenforo front end and xenforo security?

Yes

 

[WillX]

Can the owner of a forum read private messages among all users, by reading the database directly, bypassing xenforo front end and xenforo security?

Of course, if you hold the keys to the kingdom you can do whatever you want.

 

[Dixie McCall]

Yes then can directly or through DB. Will they? Depends on how sleazy the forums owner are to be quite honest. But then again. Facebook reads your private messages too.

 

[WillX]

Odds are a forum isn't going to bother reading your private messages unless there is a problem that needs to be resolved. With that said there is nothing that would prevent them from doing so. I mean if you have access to the database you can even reverse the passwords used, so don't reuse any passwords

 

[Paul B]

I mean if you have access to the database you can even reverse the passwords used

Not easily.

They're hashed.

 

[WillX]

They're hashed.

I know, but anyone that works in security knows about tables
Even salted is feasible these days.

Bottom line is it's possible, even if it's unlikely that someone is going to go through the hassle. Don't reuse passwords

 

[Mr Lucky]

Take a look at the wording here in the platform: private messages / PM are called "conversation" consequently. That points into the right meaning of their overall function.

Yes, if you call them Private Messages users may expect them to be private. There are alternatives:

Personal message
Personal conversation
Direct message
Conversation

I make it clear in my privacy policy just how private, or not private, they are and under what exact exceptional legal circumstances they might be seen by third parties.