Private Message Privacy Issues?

gulberat

We have multiple users in this thread reporting being able to see correspondence that is not theirs, including that regarding forum infractions.

I am not affected but I think this is a priority issue: http://perfectworld.vanillaforums.com/discussion/comment/12557809/#Comment_12557809

EDIT: I have seen now that I AM affected by this. See below for details.

khamseenair

Yeah as I pointed out in the other thread, I'm a good person (mostly) so I didn't go reading through all the messages in there. Just enough of them to figure out what had happened. But there could well be sensitive information in those PMs and it now appears they are open to anybody who's received a message with the same title.

The one about the infraction I mentioned was sent to me by Smirk, but in that thread there are also posts from Trendy and even Brandon about infractions. Plus all replies from players back to the devs about said infractions. That seems like something which should be addressed quickly.

primar13

I am one as well.

Gonna PM this to Trendy.

[EDIT]

Sent over Twitters.

frtoaster

I'll just quote myself from the other thread.

frtoaster wrote: »

I can confirm this bug. The thread entitled "I have a question" in my inbox includes PMs that I shouldn't be seeing. On the other hand, the warning that I received from askray is gone.

gulberat

Combing through my PM's, I realized I DID get hit with this after all, with a post called "Contact Information." Someone's thread where they were seeking out old fleetmates got merged in with one where I was sending a person on the forum my email address. Thankfully it wasn't a personal email addy--just one I used for random stuff, junk, etc., that doesn't have my real name or anything identifying attached to it, but I need to update that.

Again, the PM chain in question was titled "Contact Information." If a mod/CM wants to discuss this in private with me go ahead, but given that there is an email addy in there, I would rather not post a link or anything out here.

EDIT: I have found three more chains total, where my correspondence got mixed up with that of others--"Hello!" "Thank you." and "Signature." The last has private correspondence from @pwlaughingtrendy in it to someone besides myself, though I did not see what she actually said.

opkossy

Yeah. It seems PMs here are less a private message and more an exclusive thread that tons of people can participate in.

Which means any sort of mass mailed PM, for example, would suddenly start looking a whole lot LESS private whereas on vB (and most other forums) each individual would have their own completely private conversation.

krittycat

From what I can tell, what happened here is that all PMs from the same forum that had the same Subject line were combined into one thread. It's actually sad - I had a few PMs that were from close friends that I would have liked to keep, but because the same Subject line had personal messages from other players, I felt it was only right to delete them.

At least I got to relive the memories one more time before having to part with them...

All in all, the PM migration was a massive flop. Hopefully it doesn't continue to do so, and it was just a migration-specific issue.

opkossy

So I have 214 "unread" messages in my inbox at the moment

... And no way to actually get to them.

krittycat

opkossy wrote: »

So I have 214 "unread" messages in my inbox at the moment

... And no way to actually get to them.

Yeah, there's no "Next Page" button. You have to delete the messages that are showing until you start seeing "New" on some of the messages... Trust me, it's a long haul.

gulberat

That is definitely also a bug.

I have not deleted my affected PM's yet in case Trendy or someone else needs a test case, but yeah, I'm not going to go back and actually try to give them a real read. I mean, one of my email addresses got out. I don't know what else from other people did too.

Until I am assured it cannot happen again, I am going to be very, VERY creative in my PM titles.

tehbubbaloo

its just infraction notifications, and based on the number of them and the reasons given for issuing them:

1. i am surprised i wasnt permabanned years ago.
2. it looks like the lions share of members have been infracted.

so with that in mind... privacy? meh
i was more worried about some of the super minor things people have said that got them infracted.

gulberat

It's not just infraction notifications that got caught up in this. Other examples of thread titles are in one of my later posts.

And while you may not have a problem with your notification being seen, other people may NOT be happy with the fact that everyone else on the forum who has had one can see theirs. And since other PM threads got merged too, there could be all sorts of other private information out there.

tehbubbaloo

gulberat wrote: »

It's not just infraction notifications that got caught up in this. Other examples of thread titles are in one of my later posts.

And while you may not have a problem with your notification being seen, other people may NOT be happy with the fact that everyone else on the forum who has had one can see theirs. And since other PM threads got merged too, there could be all sorts of other private information out there.

i reckon its comedy gold. some of the replies sent to argue their moderation
so some guy looking for his fleetmates has your email address. are you really that spun out over it?
i wish i had had a pm titled 'hey baby'. that could have been an epic read hey

gulberat

Well, like I said, the particular email address that got out was one that I use specifically for stuff that I do not put my real name to. So no, it's not as big of a deal for me as it could have been. But the fact that this happened means that stuff other people considered a lot more private than that could easily be in the hands of others they don't want to have it.

And of course one person's comedy gold could be deeply embarrassing to someone else. Since those messages were sent with the expectation of being private, on general principle, privacy shouldn't have been breached.

primar13

As Many of you can Tell there are no "Subjects" on PM's anymore... That is my guess as to what caused most of this, but I don't know since none of us have access to the DB...

Lets all wait and see what trendy says tomorrow.

daveyny

Thought I'd just add my first reaction to this...

Anybody else get the message in their INBOX...,
"(Insert Your Name Here) and 544 people have received a Warning at Star Trek Online."

And then the body of the message lists EVERY SINGLE ONE OF THEM!
(along with a personal note as to why, by the Mod. offering the 'gift')

ROTFLMAO...
Oh, if only I were a lot more devious ...
Though it is nice to see that I'm not the only Bad Boy around here. <chuckle>

Hey Trendy, I think I found a BUG in the new forums... it's rather LARGE and has a delightful odor of Rottenness to it...

opkossy

daveyny wrote: »

Thought I'd just add my first reaction to this...

Anybody else get the message in their INBOX...,
"(Insert Your Name Here) and 544 people have received a Warning at Star Trek Online."

And then the body of the message lists EVERY SINGLE ONE OF THEM!
(along with a personal note as to why, by the Mod. offering the 'gift')

ROTFLMAO...
Oh, if only I were a lot more devious ...

Hey Trendy, I think I found a BUG in the new forums... it's rather LARGE and has a delightful odor of Rottenness to it...

So.... STO is getting banned? :P

ambisinisterr

Unfortunately as a moderator my inbox fills up regularly so unlike some of you I don't have any generic titled PM's such as "Removed Post." Mine are all unique PM's at this time as most of those generic PM's were from months back.

Just note that what we always said was not a bluff. Any PM moderators sent out as a moderator include the CM and other Community Moderators as a blind carbon copy (bcc) and it appears they are no longer blind so keep that in mind.

I'm not sure what can be done about those which were piled together but I'll pass it up the ladder.

aloishammer

gulberat wrote: »

And of course one person's comedy gold could be deeply embarrassing to someone else. Since those messages were sent with the expectation of being private, on general principle, privacy shouldn't have been breached.

No kidding. Imagine the combination of: some things that get said in PMs + same titles in PM boxes of certain people, or even certain fleets.

The horror...the horror

krittycat

gulberat wrote: »

And of course one person's comedy gold could be deeply embarrassing to someone else. Since those messages were sent with the expectation of being private, on general principle, privacy shouldn't have been breached.

I'll say this: Some of the PMs were VERY personal, to the point where I was actually embarrassed for the people who sent it, since I was essentially reading their messages to find my own amidst the jumble.

virusdancer

daveyny wrote: »

Thought I'd just add my first reaction to this...

Anybody else get the message in their INBOX...,
"(Insert Your Name Here) and 544 people have received a Warning at Star Trek Online."

And then the body of the message lists EVERY SINGLE ONE OF THEM!
(along with a personal note as to why, by the Mod. offering the 'gift')

ROTFLMAO...
Oh, if only I were a lot more devious ...
Though it is nice to see that I'm not the only Bad Boy around here. <chuckle>

Hey Trendy, I think I found a BUG in the new forums... it's rather LARGE and has a delightful odor of Rottenness to it...

Don't forget to hit Older Messages for continued entertainment value. Heh, lurking around the forums long enough to be able to read through the 544 post was definitely worth it. The replies to many of the warnings go great with the morning caffeine.

If you look at the URL for the messages, there at the end where you might have the #/50, you can set that # to 0 to start at the beginning (after the Forumpocalypse of 2012) and then keep hitting Newer Messages at the bottom to work your way forward if you don't want to hit Older Messages at the top to work your way back.

Just so much...fun. /facepalm

aloishammer

virusdancer wrote: »

If you look at the URL for the messages, there at the end where you might have the #/50, you can set that # to 0 to start at the beginning (after the Forumpocalypse of 2012) and then keep hitting Newer Messages at the bottom to work your way forward if you don't want to hit Older Messages at the top to work your way back.

Just so much...fun. /facepalm

And let's not forget the icing on the cake- this is after the migration was delayed to focus major attention on important issues.

-ba-dum-tss!-

angrytarg

Frankly, this is a "mistake" or "error" that shouldn't happen and needn't to happen. If anything, it shows how inadequate the new forum software is or at least how incompatible it was with the old forums - and that Nobody tested this. At all..

This is a serious privacy issue and frankly there's nothing PWE could do to compensate for this. It's embarassing.

gulberat

angrytarg wrote: »

Frankly, this is a "mistake" or "error" that shouldn't happen and needn't to happen. If anything, it shows how inadequate the new forum software is or at least how incompatible it was with the old forums - and that Nobody tested this. At all..

This is a serious privacy issue and frankly there's nothing PWE could do to compensate for this. It's embarassing.

While it would be a drastic maneuver, I think the only thing they can do is delete ALL PM's. They should perhaps download the Infractions thing on their end, but I think they need to just purge the entire PM database and start fresh. And we users need to conduct a test without their help to ensure that the problem is not recurring after the database purge is complete.

This is a severe issue and justifies a severe solution. My plan does not make up for it, but is the only acceptable containment procedure at this point.

primar13

angrytarg wrote: »

Frankly, this is a "mistake" or "error" that shouldn't happen and needn't to happen. If anything, it shows how inadequate the new forum software is or at least how incompatible it was with the old forums - and that Nobody tested this. At all..

This is a serious privacy issue and frankly there's nothing PWE could do to compensate for this. It's embarassing.

No it shows that someone is angry and coming up with any sort of "Justification" for why they could be right.

comrademoco

Yup, happened to me too... I just deleted the PMs... wont be sending on till that's fixed tho...

krittycat

It shouldn't be an issue for future messages, since there's no subject line for them to combine anymore...

Now it's essentially a delayed IM system, similar to the way Facebook changed their Message system to be folded into their IM system.

gulberat

N

krittycat wrote: »

It shouldn't be an issue for future messages, since there's no subject line for them to combine anymore...

I would say a group of four users should get together and test this theory after @pwlaughingtrendy addresses it, to make sure it can't happen anymore. Basically, have Person 1 and 2 PM each other, then Person 3 and 4 PM each other with the exact same thread title.

gulberat

Have we had any official word on redress for this situation?

trailturtle

This (^$# is broke and we're going to fix it as soon as we can. We're working with Vanilla, they're working well with us, and we'll either update or... fall asleep or something when it's done. I might do that.

I don't have a timeline on it getting fixed, but Vanilla has a dev working tomorrow who I get to pester about things.

krittycat

trailturtle wrote: »

This (^$# is broke and we're going to fix it as soon as we can. We're working with Vanilla, they're working well with us, and we'll either update or... fall asleep or something when it's done. I might do that.

I don't have a timeline on it getting fixed, but Vanilla has a dev working tomorrow who I get to pester about things.

^ Here's your official response, guys, as unofficial as he might look.