Lack of interest Separate Admin permissions for email communications

[Mr Lucky]

I have given my admins permissions for Users as it us useful for certian thinsg such as checking for duplicate registrations, deleting/merging users etc., but I'd be happier if they didn't have access to users' emails, and esecially not be able to batch email them and especially not to generate a list of all users' emails via Communication > email users.

I trust them of course, but who knows, they could suddenly get disgruntled and cause havoc with a mailout or (potentially worse) distribute the email list. In most cases I would think the ability to view and use emails is useful only to the forum owner, staff wouldn't normally need this and it adds a layer of responsibilty that could have legal implications.

Guess what prompted me to suggest this?

 

[Kirby]

If you're worried about staff with permission to admin Users getting access to users emails, you might want to be worried about this bug:
https://xenforo.com/community/threads/any-admin-can-export-user-data.147729/

 

[webbouk]

I trust them of course, but who knows, they could suddenly get disgruntled and cause havoc with a mailout or (potentially worse) distribute the email list.

Then you don't trust them.

If I was an admin on your site and this was shown to me, I would leave.

You have to accept an element of mutual trust.

 

[Mr Lucky]

If I was an admin on your site and this was shown to me, I would leave.

OK, but you aren't one of my admins. The admins on my site(s) would totally understand these concerns.

 

[Alpha1]

Over the decades I have learned from experience that there is significant value in restricting access from sensitive and functions.
Friends go sour. Accounts get hacked. Mistakes are made. It makes a lot of sense to only give access to sensitive functions, if access is needed. IMHO its common sense and has nothing to do with trust or feelings.

 

[Mr Lucky]

Then you don't trust them.

If I was an admin on your site and this was shown to me, I would leave.

You have to accept an element of mutual trust.

Let me put this from another perspective.

I am an admin on another (very large) forum site that I don't own. I have user admin access which is useful because I can change user's usergroups etc.

There is a database of close to 100,000 users and I have access to their email addresses (which I will never need)

Now if something goes horribly wrong and those emails get leaked, in the eyes of whoever investigates this hyperthetical breach I will be one of six suspects.

I would really prefer not to have that access and not to be in that position of being a potential suspect. I don't mind betting that none of the admins on my own site want to be in that position either, nothing to do with me not trusating them right now.

 

[webbouk]

That perspective makes a more sound reason and one I would be happy to accept as an admin

 

[S Thomas]

You picked one personal information, but are ignoring all the others - why? Do you differentiate between email, location, any kind of custom profile field which could contain personal information?
I would support a suggestion which separates the display of personal information to admins, yet keeps the functionality they need to operate. For example, if you're checking IPs / emails / whatever, don't show those, just display "alt account found / not found because of same IP / ...".
Pretty much "moderate/administrate user" and "edit user".

 

[Alpha1]

You picked one personal information, but are ignoring all the others - why?

The issue is contact information which has a much higher risk of abuse than an IP address or a general location.

 

[Mr Lucky]

You picked one personal information, but are ignoring all the others - why? Do you differentiate between email, location, any kind of custom profile field which could contain personal information?

Yes. Email identifies a specific person, up and location do not. Can a spammer be sold a list of IP addresses of locations?

 

[Kirby]

Can a spammer be sold a list of IP addresses of locations?

Depends on how specific the location is - if the username is the real name and the location is Demo Street 1, CA 12345 Demo City I'd say there would be a couple spammers interested in buying this dataset.

 

[Mr Lucky]

I’m not talking about street addresses, who would put that on a forum?

 

[Kirby]

Not-that-savy people (you know, those users who do not know what a browser is) do that every now and then, they put a www. in front of their email address, they call you to ask questions about everything and the kitchen sink (becasue they stumbled upon your forum for a specific question using Google and don't even know they did that), ...

 

[S Thomas]

I’m not talking about street addresses, who would put that on a forum?

Uhm, every customer-orientated forum without external shop?

The issue is contact information which has a much higher risk of abuse than an IP address or a general location.

Yes. Email identifies a specific person, up and location do not. Can a spammer be sold a list of IP addresses of locations?

Associated accounts (Skype, FB, ...), real life name plus email, general and/or exact location, gender, full birthday, mobile number, ... There is plenty of personal information accessible to admins which is insanely useful to not only spammers, but also advertisers, social hackers and pretty much anyone who wants to deal damage or profit off your data.

 

[Mr Lucky]

You picked one personal information, but are ignoring all the others - why?

I think a couple of people are missing my point. Of course there can be some data other than email addresses held and viewable to admins.

My point is that emails are different because anyone can easily make a bulk list of all emails or send out a bulk email. It is the separating the Communication section from the users section that this suggestion is about.

That is not needed for many admins who merely need user access to be able to assign usergroups, merge users etc. as part of forum business.

The problem is not the ability to view some users' data on a user by user basis, but the ability to create and export a list of all email addresses. (e.g. via copy and paste)

AFAIK this cannot be done with street addresses, IP addesses, associated accounts etc.

 

[S Thomas]

There is really no difference between data compressed in a list and data freely accessible per item (user). If someone wants to hurt you or if someone is being suspected of having done something (your two scenarios), it does not matter at all at any stage in which form data is accessible. It's just the pure fact that the data is available which leads to the actions you are trying to avoid.
In fact, just by hiding one facet of the actual problem, you're willingly challenging bad behaviour because you are not fixing the actual problem ("oh look, you can't export emails anymore" - "i bet i can"). You're just slowing down the process of exporting emails, nothing more. Unless you're proactively checking every admin action, disabling email export should never ever give you any kind of relief or security.
That's pretty much why it's useless to separate only emails from User permissions. Therefore, separating User data ("edit") from User administration ("moderate") is a better approach, although I don't know what the downsides of that would be.

Btw, if you give any admin template permissions, they could extract the information with hidden template modifications on the members list - so that nobody except the admin (or whomever they choose, it doesn't even need to be an admin account) would see it. Only restriction would be items per page. Would work on profiles or anywhere where the user entity is called aswell.

 

[Vekseid]

Over the decades I have learned from experience that there is significant value in restricting access from sensitive and functions.
Friends go sour. Accounts get hacked. Mistakes are made. It makes a lot of sense to only give access to sensitive functions, if access is needed. IMHO its common sense and has nothing to do with trust or feelings.

Been on the receiving end of having an admin get her e-mail hacked.

That was an enormous headache.

More admin permissions in general would be good.

 

[Vekseid]

I wrote a custom addon for this and related issues, adds 15 new administrator permissions.

Could release it if people are interested.

 

[Ozzy47]

I am sure at least some might like such an addon.

 

[Vekseid]

https://xenforo.com/community/resources/granular-administrator-permissions.6483/

@Alfa1 @Sabermaster @Mr Lucky @sbj

Enjoy.