Privacy alert--Email addresses being disclosed without permission
 

I want to start by saying I have NO beef with the member who emailed me in response to a PM I sent her.

What I have discovered, however, is that when someone has the option to receive email notifications of PMs (an option I have not selected, but the other member had), the email sent by SR doesn't merely disclose the fact that someone sent you an PM on the Forum, it ALSO discloses the email address of the sender!

So SR is disclosing my private email information without my permission.

I've posted on the forum troubleshooting, and I will notify the mods about this, as well, but I think everyone should be aware of this--particularly since we have members who are victims of abuse and may need their privacy protected for their own physical safety.

Just a heads-up. Hopefully this will be remedied, and quickly.

:a096:

I thought I'd come back to say...

When I joined SR I used an email address that I call a "burner" email. I never go to it, it's only for forum purposes. No one knows I have this email address, and it has a password that is different to all my other email addresses. Especially for Friends & Family, if you used a normal or shared email, I'd change it to one no one knows about. You can change it on your profile page (go to User CP, Edit details)

No, I know that. I use this particular email for only a few sites. But the thing is, even THAT should remain private. And it isn't a huge issue for me, personally, but it's possible to imagine a scenario where that could be highly dangerous. There is ZERO reason to disclose personal email addresses. The only reason I found out about it is that this other member happened to exercise the option to use my email address, which LOOKS like something I had allowed. But I've gone through all the options and I see nowhere that you can give, or withhold, permission to disclose it.

Lexie, go to your "user control panel" page. Scroll down to "Settings and Options", then go to Edit Options, and click there. The second item under that heading says "Allow vCard Download" and then goes on to say this:

You may choose to allow other users to download a vCard containing your email address and username.

If you want to keep your email address private, do not allow vCard downloads.

It doesn't exactly jump right out at you, but it looks like maybe this is a way to keep your email private?

ETA: I just put my cursor over Lexie and bimini's names and only got "send X a PM" as an option. When I put my cursor over my own name, there is "send X an email" as an option. My account is set up to "allow vCard downloads." How about you other folks?

hp, thanks...mine is disabled.

Also, just below that is, "Receive Email from Other Members" and also, "Receive Friendship Request Email," and, "Receive Email Notification of New Private Messages."

I have no check marks in any of those...you guys might want to check on that, too. I don't know what the default settings are. I've disabled a lot of stuff myself.

Nope, I have the "allow vCard download" option UNCHECKED. The details are actually in the body of the email that SR sends.

I take back my prior statement--I am NOT set up to "allow vCard downloads", yet it is an option to email me when the cursor is put over my name...

This sure does need looking into, Lexie!

Anna, one of the Admins here, posted on my thread in the Troubleshooting forum that she has no idea how this could happen. She assured me they will look into it immediately.

I told her I can send her the email I received--which has attached the email SR sent to the other member disclosing my email address.

I suspect all that needs to be done is to change the content of the automatic emails, but geeze--pretty big goof.

This just gets weirder, the more I look at it. I don't want to double-post everything I have on the other thread, but check it out: http://www.soberrecovery.com/forums/...ermission.html

Morning Glory is looking into it, too.

We have the whole world looking into this. The network admins have been notified and we'll pass along what they find out as soon as we hear.

Mike :)

UPDATE:

It appears that I inadvertently sent my message to the other member via email, not PM. She had the option to receive emails checked. I was thinking I was sending a PM, but it was actually a communication via email.

Still, there's nothing that tells you that sending an email automatically discloses your email address. I would assume that nothing but my user name would appear, and that any reply via email would have to go through SR.

I've updated the admin staff, so they don't go looking in the wrong places. I honestly thought I had sent a PM. Seems like there should, at the very least, be some kind of warning that sending a message via email results in disclosure of your own email address so the person can reply directly to you. It's still troublesome.

No worries Lexie. This kind of privacy issue is something we take very seriously. Much better to be over careful and pay attention to every detail.

Mike :)

Aaaannnnddd... I just tested, and there actually IS a notice that the email will be disclosed.

So can I do my best Emily Littella and say, "nevermind" ?

Speaking of Littella, though, the warning is in teeny-tiny print. Would be nice if it were bigger--and I still think that having all communications go through SR, unless the parties affirmatively share their emails, would be better.

Sorry to hit the alarms. I just was pretty freaked out by what looked like a huge glitch.

ETA nevermind ;)

I'm glad that we're getting to the bottom of it.

I have to add tho when I send an email there's a little caveat down below the box where I enter my text

For that reason I have a special SR email account I set up via ***** that is only used here.

D

It's a teensy-weensy caveat, though, isn't it? :)

Yes, a lawyer should be paying attention to the fine print. We OLD lawyers have a harder time reading it.

I've never used the "email other member" option in my life. I ALWAYS send PMs, and I had assumed that's what I was doing this time, too. Petty easy to make the mistake. Maybe a little too easy.

I'd like to propose that this option be reconsidered. Is it really necessary?

in this thread, I see it with yours and dee's. no one elses

oops. deserteyes,too.