Pm's and mods

[Adam]

Just wanna know is it not a act of 'invasion of privacy' if a mod can go through ur pm's at will? This isnt concerning migweb but another site I am on and would like to know whats the deal here asap.

ta

[Steve!]

didn't think mods had access to PM's

[Adam]

well on another site they did and i just opened up a new WW.

[Steve!]

runs off to delete pm's

[Frisco]

Dont know about here but we can't on mk2cav.com

[Steve!]

Thought as much!

[turbo gav]

Some admin can on some sites I know for a fact.

[RobJenko]

we dont have access to users pm's on mig. not even mike can do it. same as seeing your passwords etc.

[Allvaux]

Adam: wait until the moderator in question mentions he was at a car show or something and came on his own. Then three days later pm someone and say you were round at his house on that day at a certain time banging his missus and she's a right dirty old go-er. Bet he ****ing says something then to give it away.

[Melv]

Originally Posted by Allvaux

Adam: wait until the moderator in question mentions he was at a car show or something and came on his own. Then three days later pm someone and say you were round at his house on that day at a certain time banging his missus and she's a right dirty old go-er. Bet he ****ing says something then to give it away.

[Adam]

tbh i dont think u can even say **** on a cat forum lol anyways dont matter now i been banned

[tathan]

you can if you really want to but it isn't just a 'click and look' thing. if you can download the database you can find it in there iirc.

[lethal]

Originally Posted by RobJenko

we dont have access to users pm's on mig. not even mike can do it. same as seeing your passwords etc.

I beg to differ.

Mike could almost certainly fire up his Mysql client and look up PMs directly from the database (should he choose to do so)

[OHC]

pm stands for private messages (i know that's obvious) but that's the whole point private although i think the owner(s) have the right to do it but only under specific circumstances I.E spamming or harassing, or that's how it works on sites i host.

[chip]

Originally Posted by Allvaux

Adam: wait until the moderator in question mentions he was at a car show or something and came on his own. Then three days later pm someone and say you were round at his house on that day at a certain time banging his missus and she's a right dirty old go-er. Bet he ****ing says something then to give it away.

[chip]

Originally Posted by lethal

I beg to differ.

Mike could almost certainly fire up his Mysql client and look up PMs directly from the database (should he choose to do so)

Indeed, as per any electronic system, the administrators will be able to gain access to the data if they wish to.

[Twelfty]

*twelfty pms someone random and confesses to killing 30 ppl at a secret meet* :O

[lethal]

Originally Posted by chip

Indeed, as per any electronic system, the administrators will be able to gain access to the data if they wish to.

There are cases when the administrators will be unable to read user information. For example, in most modern BB software, the administrators can't read a user's password as only the hash is stored.

Other networked systems avoid adminstrator privacy invasion using encryption where only the two parties communicating have keys. It might not be a bad idea for a PMs plugin but it would be a pain in the ass to implement as even a relatively advanced 'forum user' is probably not going to understand how to perform key-signing correctly.

[chip]

Lethal, if Mike stored a backup of your password hash and then he copied his password hash onto your account record, he could log in as you and read your PM's, then he could copy your hash back, and it would appear as if nothing had changed.

If you have sufficient administrative access to a system there is always a way.

[Adam]

ohwell what a positive thread i have un-folded

[lethal]

Originally Posted by chip

Lethal, if Mike stored a backup of your password hash and then he copied his password hash onto your account record, he could log in as you and read your PM's, then he could copy your hash back, and it would appear as if nothing had changed.

That's very true. Of course, with adminstrative access to the database, even fiddling with logins isn't necessary to effect user's content.

My point was rather that well written software only stores the hash, not the password. Assuming this is the case, Mike should not have our passwords, only the hashes.

Vbulletin also salts the hash with a unique IV so two identical passwords on different accounts do not have the same hash but that's beside the point.

The critical thing from a security standpoint is that a third party that steals the database from Mike cannot use login credentials found in Migweb's database to login as a user at, say, Vauxsport even if the password used were the same*

Yeah, so I went off topic.

*All this assumes that Mike isn't a wiley espionage expert who has recoded Migwebs authentication page to send your passwords to the database in plaintext!

[chip]

Lethal, I think the key thing is, if you have something REALLY important to talk to someone about, dont do it on a forum, lol

[lethal]

Originally Posted by chip

Lethal, I think the key thing is, if you have something REALLY important to talk to someone about, dont do it on a forum, lol

Well yeah, you're probably better off getting in the car and going to see them in person

[Adam]

excuse me there be no dogging parafenalia on my threads

[jamied]

Mods can't see pm's of other people and there is no way im looking at adam's ones....im not that brave....or perverted..