Privacy alert--Email addresses being disclosed without permission
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
Privacy alert--Email addresses being disclosed without permission
I want to start by saying I have NO beef with the member who emailed me in response to a PM I sent her.
What I have discovered, however, is that when someone has the option to receive email notifications of PMs (an option I have not selected, but the other member had), the email sent by SR doesn't merely disclose the fact that someone sent you an PM on the Forum, it ALSO discloses the email address of the sender!
So SR is disclosing my private email information without my permission.
I've posted on the forum troubleshooting, and I will notify the mods about this, as well, but I think everyone should be aware of this--particularly since we have members who are victims of abuse and may need their privacy protected for their own physical safety.
Just a heads-up. Hopefully this will be remedied, and quickly.
What I have discovered, however, is that when someone has the option to receive email notifications of PMs (an option I have not selected, but the other member had), the email sent by SR doesn't merely disclose the fact that someone sent you an PM on the Forum, it ALSO discloses the email address of the sender!
So SR is disclosing my private email information without my permission.
I've posted on the forum troubleshooting, and I will notify the mods about this, as well, but I think everyone should be aware of this--particularly since we have members who are victims of abuse and may need their privacy protected for their own physical safety.
Just a heads-up. Hopefully this will be remedied, and quickly.
Member
Join Date: Mar 2014
Posts: 25,373
I thought I'd come back to say...
When I joined SR I used an email address that I call a "burner" email. I never go to it, it's only for forum purposes. No one knows I have this email address, and it has a password that is different to all my other email addresses. Especially for Friends & Family, if you used a normal or shared email, I'd change it to one no one knows about. You can change it on your profile page (go to User CP, Edit details)
When I joined SR I used an email address that I call a "burner" email. I never go to it, it's only for forum purposes. No one knows I have this email address, and it has a password that is different to all my other email addresses. Especially for Friends & Family, if you used a normal or shared email, I'd change it to one no one knows about. You can change it on your profile page (go to User CP, Edit details)
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
No, I know that. I use this particular email for only a few sites. But the thing is, even THAT should remain private. And it isn't a huge issue for me, personally, but it's possible to imagine a scenario where that could be highly dangerous. There is ZERO reason to disclose personal email addresses. The only reason I found out about it is that this other member happened to exercise the option to use my email address, which LOOKS like something I had allowed. But I've gone through all the options and I see nowhere that you can give, or withhold, permission to disclose it.
Member
Join Date: Mar 2013
Location: Midwest
Posts: 11,481
Lexie, go to your "user control panel" page. Scroll down to "Settings and Options", then go to Edit Options, and click there. The second item under that heading says "Allow vCard Download" and then goes on to say this:
You may choose to allow other users to download a vCard containing your email address and username.
If you want to keep your email address private, do not allow vCard downloads.
It doesn't exactly jump right out at you, but it looks like maybe this is a way to keep your email private?
ETA: I just put my cursor over Lexie and bimini's names and only got "send X a PM" as an option. When I put my cursor over my own name, there is "send X an email" as an option. My account is set up to "allow vCard downloads." How about you other folks?
You may choose to allow other users to download a vCard containing your email address and username.
If you want to keep your email address private, do not allow vCard downloads.
It doesn't exactly jump right out at you, but it looks like maybe this is a way to keep your email private?
ETA: I just put my cursor over Lexie and bimini's names and only got "send X a PM" as an option. When I put my cursor over my own name, there is "send X an email" as an option. My account is set up to "allow vCard downloads." How about you other folks?
Member
Join Date: Mar 2014
Posts: 25,373
hp, thanks...mine is disabled.
Also, just below that is, "Receive Email from Other Members" and also, "Receive Friendship Request Email," and, "Receive Email Notification of New Private Messages."
I have no check marks in any of those...you guys might want to check on that, too. I don't know what the default settings are. I've disabled a lot of stuff myself.
Also, just below that is, "Receive Email from Other Members" and also, "Receive Friendship Request Email," and, "Receive Email Notification of New Private Messages."
I have no check marks in any of those...you guys might want to check on that, too. I don't know what the default settings are. I've disabled a lot of stuff myself.
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
Anna, one of the Admins here, posted on my thread in the Troubleshooting forum that she has no idea how this could happen. She assured me they will look into it immediately.
I told her I can send her the email I received--which has attached the email SR sent to the other member disclosing my email address.
I suspect all that needs to be done is to change the content of the automatic emails, but geeze--pretty big goof.
I told her I can send her the email I received--which has attached the email SR sent to the other member disclosing my email address.
I suspect all that needs to be done is to change the content of the automatic emails, but geeze--pretty big goof.
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
This just gets weirder, the more I look at it. I don't want to double-post everything I have on the other thread, but check it out: http://www.soberrecovery.com/forums/...ermission.html
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
UPDATE:
It appears that I inadvertently sent my message to the other member via email, not PM. She had the option to receive emails checked. I was thinking I was sending a PM, but it was actually a communication via email.
Still, there's nothing that tells you that sending an email automatically discloses your email address. I would assume that nothing but my user name would appear, and that any reply via email would have to go through SR.
I've updated the admin staff, so they don't go looking in the wrong places. I honestly thought I had sent a PM. Seems like there should, at the very least, be some kind of warning that sending a message via email results in disclosure of your own email address so the person can reply directly to you. It's still troublesome.
It appears that I inadvertently sent my message to the other member via email, not PM. She had the option to receive emails checked. I was thinking I was sending a PM, but it was actually a communication via email.
Still, there's nothing that tells you that sending an email automatically discloses your email address. I would assume that nothing but my user name would appear, and that any reply via email would have to go through SR.
I've updated the admin staff, so they don't go looking in the wrong places. I honestly thought I had sent a PM. Seems like there should, at the very least, be some kind of warning that sending a message via email results in disclosure of your own email address so the person can reply directly to you. It's still troublesome.
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
Aaaannnnddd... I just tested, and there actually IS a notice that the email will be disclosed.
So can I do my best Emily Littella and say, "nevermind" ?
Speaking of Littella, though, the warning is in teeny-tiny print. Would be nice if it were bigger--and I still think that having all communications go through SR, unless the parties affirmatively share their emails, would be better.
Sorry to hit the alarms. I just was pretty freaked out by what looked like a huge glitch.
So can I do my best Emily Littella and say, "nevermind" ?
Speaking of Littella, though, the warning is in teeny-tiny print. Would be nice if it were bigger--and I still think that having all communications go through SR, unless the parties affirmatively share their emails, would be better.
Sorry to hit the alarms. I just was pretty freaked out by what looked like a huge glitch.
Administrator
Join Date: Apr 2007
Location: Australia
Posts: 211,442
ETA nevermind 
I'm glad that we're getting to the bottom of it.
I have to add tho when I send an email there's a little caveat down below the box where I enter my text
For that reason I have a special SR email account I set up via ***** that is only used here.
D
Originally Posted by LexieCat 
UPDATE:
Still, there's nothing that tells you that sending an email automatically discloses your email address. I would assume that nothing but my user name would appear, and that any reply via email would have to go through SR.
Still, there's nothing that tells you that sending an email automatically discloses your email address. I would assume that nothing but my user name would appear, and that any reply via email would have to go through SR.
I have to add tho when I send an email there's a little caveat down below the box where I enter my text
Note: By using this form, your email address will become available to the user who you are emailing.
D
A work in progress
Thread Starter
Join Date: Jul 2010
Location: South Jersey
Posts: 16,633
It's a teensy-weensy caveat, though, isn't it? 
Yes, a lawyer should be paying attention to the fine print. We OLD lawyers have a harder time reading it.
I've never used the "email other member" option in my life. I ALWAYS send PMs, and I had assumed that's what I was doing this time, too. Petty easy to make the mistake. Maybe a little too easy.
I'd like to propose that this option be reconsidered. Is it really necessary?
Yes, a lawyer should be paying attention to the fine print. We OLD lawyers have a harder time reading it.
I've never used the "email other member" option in my life. I ALWAYS send PMs, and I had assumed that's what I was doing this time, too. Petty easy to make the mistake. Maybe a little too easy.
I'd like to propose that this option be reconsidered. Is it really necessary?
Member
Join Date: Apr 2012
Location: northern michigan. not the U.P.
Posts: 15,281
Originally Posted by honeypig
I take back my prior statement--I am NOT set up to "allow vCard downloads", yet it is an option to email me when the cursor is put over my name...
This sure does need looking into, Lexie!
This sure does need looking into, Lexie!
oops. deserteyes,too.
Currently Active Users Viewing this Thread: 1 (0 members and 1 guests)
