Lack of interest (xf2) avoid friendly urls in /conversations/

[Marcus]

to avoid url sniffing.

 

[ENF]

to avoid url sniffing.

Isn't the default error "The requested conversation could not be found." if the user doesn't have access to the conversation? (Same as XF1 as I recall)

 

[Marcus]

the conversation title is visible. The content is protected.

 

[ENF]

the conversation title is visible. The content is protected.

I can't see the conversation title... (testing with a valid conversation URL that I know is there but accessing from a guest and user that's not in the conversation.)

You can put whatever you like in the URL, guessing, but the system doesn't confirm or reveal the existence of a valid conversation title. UNLESS, you've modified something that would make this possible

I'm being persistent here because this would be a significant issue for us but I can't reproduce a case that would risk the content of a conversation title. (or URL)

 

[Marcus]

the service provider (telecommunications provider) has access to the urls you visit.

 

[ENF]

the service provider (telecommunications provider) has access to the urls you visit.

Yes, the [webserver*] logs would show the URL but in this case, we're not going to worry about if an ISP is spying on a specific website. I'm not an ISP, but I understood that by basic principle HTTPS traffic (url details) cannot be read by ISP/Telcom providers. Domains, yes. Specific URLs, no.

*Concurrently, proper access controls should be in place on any logging facility. That's on the site operator and/or hosts, etc. It becomes an ethics issue if a host is eavesdropping on their client's logs. (and so on...)

 

[DragonByte Tech]

the service provider (telecommunications provider) has access to the urls you visit.

Then perhaps you should invent some form of code language on your forum so that you don't divulge details of your drug deals in the title of the conversations. If TV has taught me anything (and we all know the TV, like the internet, never lies), plant names are common substitutes.

Chrysanthemum = weed, cactus = E, etc.

If you do this, you won't have to worry about your ISP passing on the details they see in the URLs to the police. Unless your website domain is already on a list, in which case you may need a new domain name.

Or alternatively you can just not sell drugs on your forum, there's always that


Fillip

 

[ENF]

Then perhaps you should invent some form of code language on your forum so that you don't divulge details of your drug deals in the title of the conversations. If TV has taught me anything (and we all know the TV, like the internet, never lies), plant names are common substitutes.

Chrysanthemum = weed, cactus = E, etc.

If you do this, you won't have to worry about your ISP passing on the details they see in the URLs to the police. Unless your website domain is already on a list, in which case you may need a new domain name.

Or alternatively you can just not sell drugs on your forum, there's always that


Fillip

Wow. Ok... Good answer. Glad I don't have THAT problem, lol!

 

[Marcus]

i think the conversation has gone a bit off topic, but we can all agree we do not need to convert conversation urls into "friendly urls" so that search engines put them higher in their search results.

 

[DragonByte Tech]

i think the conversation has gone a bit off topic, but we can all agree we do not need to convert conversation urls into "friendly urls" so that search engines put them higher in their search results.

All jokes aside, it would make absolutely no sense to have Conversations be the only thing not using friendly URLs. That would be a huge inconsistency and would require them to either build a whole new system, or partially rebuild the existing system, to support something that (I'd wager) no-one other than you want.

Add that to the fact that they would be drowning in support tickets asking why the conversations weren't using friendly URLs, you've got yourself a prime candidate for the "thanks but no thanks" bin.


Fillip

 

[HWS]

Friendly URL or not, titles of private conversations should not be disclosed in the URL. Thats a fact.
Should be solved for XF1 and XF2.

 

[Kirby]

Although a bit hacky, this can achieved with route filters:

Search: conversations/{title:string}.{id:digit}
Replace: conversations/{id:digit}.{id:digit}

 

[Marcus]

I also see my users conversation topics live in google analytics live view.

 

[Kirby]

Bumping this up.
This really should be turned off for privacy reasons.

 

[S Thomas]

I also see my users conversation topics live in google analytics live view.

What? How? Did someone publicly post that link?

Bumping this up.
This really should be turned off for privacy reasons.

What kind of privacy reasons are you talking about?

 

[Slavik]

Quite, failing to see the issue here, as the site admin your have the ability to access those conversations in all kinds of ways if you wanted to snoop.

If you dont want them showing in analytics for... (genuinely no idea, but whatever) then just add the relevant analytics code to snip out everything past url.com/conversations to the conversations template.

 

[Kerstin28]

Conversations are private and so is the title of a conversation.

By using friendly URLs, the title leaks out into access logs, browser histories and via referer to third-party websites. Apart from Google Analytics the title goes to log analysis tools like Webalizer or browser toolbars like Alexa.
Granted, if the site admin or user chooses one of these tools, they have already decided to sacrifice privacy at this point. Still, there is a significant difference whether we sacrifice metadata or contents of a private conversation (which, again, the title is one part of).

For example:

• I'm willing to let Google know which user has clicked which part of my site and what users publicly wrote. But I'm not willing to let Google know what users privately wrote.
• I'm willing to share aggregate statistics with my community about which URLs are the most popular. But I'm not willing to inform my community which titles are used in private conversations.
• I'm willing to let third-party websites know via referer where the user comes from. I'm not willing to let third-party websites know what they have written in private.

For each of these examples there is a point solution, where the site admin takes steps to make sure the title gets removed in one specific use case. I don't think this is the right way. The right way is: don't put contents of private conversations into URLs. Users don't expect the title to be treated differently (i.e. with a lesser degree of privacy) than the message.

 

[Mr. Jinx]

Last week I also saw some URL's in analytics that revealed some private conversation info I shouldn't and don't want to know about.
I have immediately turned off titles in URL's for conversations to prevent this. Should be turned off by default, or an option.

 

[Mr Lucky]

Am I right in saying although Google shows the URL (hence title) in Analytics, there is no way these URLs can be indexed in Google Search Engine.

And so the only people who can see it is the site owner with analytics account and any analytics users they may have granted permission to view these analytics.

 

[Mr. Jinx]

This...

By using friendly URLs, the title leaks out into access logs, browser histories and via referer to third-party websites. Apart from Google Analytics the title goes to log analysis tools like Webalizer or browser toolbars like Alexa.