Moderators access to PM accounts

[Surfcrest]

Moderators access to PM accounts

Once again, the topic of "Moderators access to PM accounts" has come up and so I would like to explain our simple controls for you;

With the Administration Control Panel for the phpBB Board controls, as the moderator I can manage any user name or registered member of the Board.



There are two applications I can use to manage the user, with the controls I have available.

The total extent of the registration information; email address and IP address at registration is in the user control panel.



The moderators choice of controls include;

Ban by username Using this control would ban that user and any subsequent user, from registering with this username.

Ban by email Using this control would ban this user and any subsequent user from registering with this email address.

Ban by IP Using this control would ban this user and any subsequent user from registering from this IP address

Ban Anytime I use the ban controls, a user trying to access the site when they are banned by username, email or IP address will receive a message telling them they are banned from accessing the site. I can custom tailor that message for each individual ban I log, so that the user receives the message (Had great fun with that with my TBB friends, they'd even confirm they received the message by repeating it on the TBB =)) )

Deactivate account This suspends the user's ability to access his account. The membership would be deactivated, but the user's posts would remain, his account would appear active and members could find that user in a search and search through the user's posts.

Delete signature I believe this might allow me to remove a member's signature, I've never used it but I imagine if someone had spam or an inappropriate link in their posting signature I could remove it.

Delete avatar This might allow me to delete someone's avatar, I've never used this one and am not sure if it would even work.

Move all posts I have no idea what this might do, but I imagine it would make quite a mess if if did what it suggests. First, I would need a place to move someone's posts to (The Holding Room or my Shop forum). There were suggestions I did that with all Neal's toxic posts, but I'd rather leave them in the original threads to maintain the original conversation. Fortunately, a year later they are getting buried in the archives and I'm certainly not going to spend the time to go looking for them. I have left his accounts Neal and darkdays active, but I am unable to reactivate the accounts that he deactivated himself (DaBoss, Unkiebuck, justme etc) and so they aren't in our search database by user name any longer.

Delete all posts This would, as it says allow me to delete all posts. I might use this if I wanted to only deactivate the member, but delete all his posts.

Delete all attachments This would allow me to delete all attachments that someone posts, I can't imagine why I'd need to use this one.

Empty PM Outbox This is the controversial one. When Neal was soliciting for members for Cruising Gay Thailand by sending members here PM's to join, I used this to empty his PM Outbox of those PM's (Just in case he had any) before I suspended his ability to use our PM feature. I cannot read these PM's or even see that he has any, or not. When I push the button, whether there are outgoing PM's or not...they're gone! I've used this feature on all of the 6 that I've had to deactivate for being difficult so that whatever PM's they sent on their way out the door followed them out the door unread.

In our Permissions controls, I can move a newbie into full membership status, move a full member into moderated status, I can remove their PM privileges or I can add privileges, I could make a member a moderator.

Force reactivation I sometimes get registrants that register with their email address spelled wrong and so they never receive the activation email with the links to activate their account. Once they've registered with that user name they can't reregister with the same user name because it is locked and already taken with the misspelled email address. I could force reactivate and allow the user to go in and change their email address and access that user name again.

I can also use the delete user controls, knowing that when I delete someone that action is permanent and I can not undelete them later or reactivate a deleted user name.

We have managed to stitch one member back together (Smiles) who was deleted under Neal's rule and link him up with his old deleted name (Smiles) and join his posts back up.
There are a few more (Scotty, NIrish etc) that we haven't been able to rejoin the present / past memberships yet.



When I delete a user, I can delete all of his posts when I delete him or retain the posts.

When we used to have spam getting in, registering and posting ...I would use this function to zap the spam user and any posts they made.

I have never used this on an actual member, because to delete their posts would leave threads with holes in the conversations.

I hope this explains the extent of controls available to the moderator.

From the moderators-access-accounts-private-content thread you will learn, as I have that the content of any member's PM's may exist in the code of this software if you were to pull that code apart and examine it. That is not part of the moderators controls and would probably require a fair bit of expertise in how the Board code works and is stored to find whatever PM information any member has stored in their PM boxes.

http://sawatdeenetwork.com/forum/mod...nt-t28825.html

So, while it may be possible...it is highly improbable that I or Neal, for that matter has deciphered the code of this Board's software to the point of reading any of your PM's. Having said that, from a personal security basis, it is probably best not to share or save any sensitive information that you want to keep secure anywhere other than on your personal hard drives or devices. If you are going through "Customs / Boarder Security" even any information on your portable devices (texts, emails, addresses, links and attachments) are subject to examination.

If you have any questions on the moderator's controls or the security of your PM boxes, please let me know!

Surfcrest

Similar Threads:

• Moderators access to PM accounts private content
• list owners and moderators saturation posts
• bank accounts

[Smiles]

Thanks Surfcrest for this very detailed description of what you are able to do as an Admin, and ~ more importantly to this particular thread ~ what you cannot do.
There are some folks who will never believe that the Admin/Mods cannot read Members' PMs, and it will be impossible to convince them otherwise. So it comes down to individual trust at the end of the day. Not the very best position you are in, granted. But not the worst either.

Neal's basic problem was that almost no one trusted him by the end of his reign.

[scottish-guy]

I understand all of the above - and what an honest board owner can and can not do.

But in this case we are not talking about such a person.

Surely you must remember the long description given by Neal as to how he was allegedly shown (let's leave out who by, as that was almost certainly another lie - and it doesn't take a genius to work out who the real " teacher" was (glug, glug) ) how to over-write a user's password to gain access to their account. The only sticking-point with that is that the user would surely realise his p/w had been changed, as Neal insisted there was no way of restoring it. Whether that's true or not, I have no idea

So, as yet there is no explanation of a447 and Marsilius having PMs deleted from their inbox.

As for my own situation of having my outbox emptied, I understand perfectly how that can be done from the "Control panel" - but I would still class that as accessing/interfering with my PM facility.

[colmx]

So, as yet there is no explanation of a447 and Marsilius having PMs deleted from their inbox.

That would be very easy...I presume that the board has a MySQL backend...
One would use the phpmyadmin tool to access the MySQL DB that the board sits upon and delete messages based on userID
The same tool could also be used to read all messages in the Database (unless they are hashed - which i doubt)

It could probably also be used to Send fake messages as another user

A student with 13 weeks experience in php would know how to do this...
(Note that i am not saying that Surfcrest knows how to do this... But i'm pretty sue RonThai does!)

Of course you would need some sort of "root" access to the server in order to access the DB... but considering Neal had a "programmer" that he so often used to boast about having - that would have been pretty trivial

[scottish-guy]

... the board has a MySQL backend...One would use the phpmyadmin tool to access the MySQL DB....

Yes, that's what I meant to say

[Surfcrest]

I understand all of the above - and what an honest board owner can and can not do.

As for my own situation of having my outbox emptied, I understand perfectly how that can be done from the "Control panel" - but I would still class that as accessing/interfering with my PM facility.

Then let me say there are only two instances where I would ever use this function and empty a member's "Outbox" (Where their PM's that have been sent, but have not been read yet by the intended receiver are stored).

1. When their PM privileges are being revoked.
2. When they are being deactivated.

But in this case we are not talking about such a person.

Surely you must remember the long description given by Neal as to how he was allegedly shown (let's leave out who by, as that was almost certainly another lie - and it doesn't take a genius to work out who the real " teacher" was (glug, glug) ) how to over-write a user's password to gain access to their account. The only sticking-point with that is that the user would surely realise his p/w had been changed, as Neal insisted there was no way of restoring it. Whether that's true or not, I have no idea

I've gotten to know a whole different ronthai / smoothlegs leading up to the weeks of Neal's passing. I don't think Ron and Neal were working together until after Smoothlegs left Sawatdee (He asked to resign / I deactivated him and later banned him for something else). There was only one other technical guy working with Neal during the Sawtdee Forum days and he continued to work with me after I bought the site and after I deactivated Neal. He's a great guy, I trust him 100% and I know he has / had no interest in our site other than he once hosted it.

So, as yet there is no explanation of a447 and Marsilius having PMs deleted from their inbox.

I know of no possible way the phpBB controls could be used to access, read or delete PM's.
If your PM Box was full (100%) your Box (Inbox, Sent) would start to automatically manage your PM's based on your personal settings.



One more important thing to mention with the moderator's user control explained in the original post, I can also change a member's email (again if they misspelled it in registration or the original email they signed up with doesn't exist anymore / by request). I could also change their password for them or assign them a temporary generic one to re access the site.



A member would know that a moderator did this, because they would not be able to access the site with the password they know. The moderator could not know what the member's original password was. The owner of the user name is the holder of the email address we have on file.

Surfcrest

[scottish-guy]

So, what would happen then if a dishonest Admin/Mod changed my email address to one of his own, then requested a password reminder, then (having got it), changed the email address back again?

Would he in fact receive my password in the reminder (and therefore be able to access my PMs) or is it (more likely) a password reset link that is generated?

[Surfcrest]

So, what would happen then if a dishonest Admin/Mod changed my email address to one of his own, then requested a password reminder, then (having got it), changed the email address back again?

Would he in fact receive my password in the reminder (and therefore be able to access my PMs) or is it (more likely) a password reset link that is generated?

Yes, you are absolutely correct.



I could go to this screen, change the email address to my own or I could simply change the password to my own password.
Then I could access the site through that person's log in, read their PM's...send a few, perhaps even post as though I were them.
Once I was done, I couldn't give them back access without them knowing because the password would be different.

The password reminder that we send out isn't a copy of the forgotten password.
It is rather a link that allows you to re-set your password and create a new one for yourself, even if you want to change it to what it was.
We don't tell you what it was, because we don't know what it was.
We just send you a link so that you can re-set it yourself.
So you would always know someone was logging in through your account as you if it ever happened by a password change.

For the 6 memberships that are deactivated, I could also go into their accounts through a new password change or a new email address.
They would never know because we aren't expecting them back anymore...so they'll never have the opportunity to notice their changed password or see their changed email address.
A member that wanted to know would know, by the last active date of the member.
If Neal, Smoothlegs, Zebedee, Khor tose, kjun12 or timmberty showed as being last active different than the day we last saw them....?
Then you'd know something's up!

Surfcrest

[Gaybutton]

Surfcrest, no matter what you say or do, there will still be people who are convinced that you as a board owner, me as a board owner, and other board owners would go through people's PMs even if there was an easy way to do it. This board has over 700 listed members. I have nearly 200 on my board. Perhaps some think we're actually going to sit down and wade through whatever PMs may have been written, do that on a daily basis - you know - just to check, that we have no respect for privacy, and that we give a damn about what they may written to each other in the first place.

Folks, whether you believe it or not, I have no access to other people's PMs. Surfcrest has no access to other people's PMs. I, and I believe also Surfcrest, would never read other people's personal messages even if we could.

I, for one, couldn't care less what people write privately to each other. I'm not even remotely interested. I believe Surfcrest feels the same way. I wonder which of you out there actually think that I, Surfcrest, or any other board owner gives a shit about your PMs.

However, for people who remain suspicious anyway, well - you could always simply not send PMs. You could also communicate with whoever you are trying to contact by sending them an Email. Nobody thinks we can access and read your Emails do you?

[Smiles]

Good thread Doooods, with lots of information.
And yes, Mr Gaybutton (" ... Nobody thinks we can access and read your Emails do [they]? ... "), they undoubtedly do think that.