Private Messages

[Pina]

When Stitcher's Guild Reloaded started one could see the sender's private email address in a PM - not anymore !

On Sunday I received an email from a Stitcher's Guild member with her first and surname under a link in the email. I opened it and wondered why the member sent me an article by Stephen William Hawking. After I replied to the member's email - it was returned - then I sent the member a PM asking - if her email was hacked. Today I received 3 nasty PMs from the member. She thinks I sent her a virus.  Not ! !

A few minutes ago I replied to the member's insulting PMs I will show here,if the member doesn't apologize !

"Honestly,I have no idea why you are upset with me !

The link in the email I thought was from you - was not a virus  ! I opened it up thinking the email I deleted since was from you. The article was from Stephen William Hawking.

I think you owe me an apology ! ! I have never harmed anyone in my whole life !"

[matka]

That sounds very upsetting Pina, and I am sending you a hug! The problem with the internet and electronic communications is that there are too many opportunities for misunderstandings and hurt feelings. I hope it gets resolved soon.

[DragonLady]

 Oh dear....

I've received a pm from someone else, telling nearly the same story.

That is worrisome, as I have to wonder if SG's  server has been compromised.  Just what we need, on top of all the other bugs.

I will look further into it.

[DragonLady]

A few minutes ago I replied to the member's insulting PMs I will show here,if the member doesn't apologize !

No.

I do not tolerate posting the contents of private messages on the open forums. It NEVER resolves any problem, and only makes a sore situation into an ugly mess.

[DragonLady]

Everyone:

I'm investigating this matter, as I type.

If anyone receives any emails or private messages that contain unexpected links, please do not click on them.

I'm trying to determine if our system has been compromised.

[Judith]

 Pina wrote "When Stitcher's Guild Reloaded started one could see the sender's private email address in a PM - not anymore !"

I would not want my email address to be visible - would prefer to keep any private conversations with other members on the PM site.

Judith

[DragonLady]

Pina wrote "When Stitcher's Guild Reloaded started one could see the sender's private email address in a PM - not anymore !"

I would not want my email address to be visible - would prefer to keep any private conversations with other members on the PM site.

Judith

It should not be visible to anyone, anywhere, under any circumstances.

I wish someone had reported to me long ago that email addresses were showing up in private messages, because that is a serious security hole.

I'm trying to figure out how this all happened, so we can make sure it never happens again.

In the meantime, to all parties involved:

I have the private messages.  All of them. I'm investigating the whole situation, and trying to determine what went wrong to cause all this, so it can be fixed ASAP.

I assure you: this is a top priority for me, and I will do all I can to get to the bottom of it.

[Garden Girl]

This might be related. Last night, rather late, I was checking the members list looking for someone. I noticed that about half the members show an e-mail icon by their name. In curiosity I clicked on the icon for one of my pals and in the message box it showed my full personal e-mail info. I assumed it would be sending them directly an e-mail as opposed to through the private message system. I clicked out. 

My personal settings don't show my e-mail for here. I had to set it that way myself. Pina, I just checked and your settings would allow me to send you an e-mail directly if I understand this correctly.

I imagine a lot of our members do not realize their settings allow direct contact.

Don't know if this helps at all, but I was going to let you know about it today just in case.

[Pina]

Thanks,Rene !
I tried several times - now my email isn't visible.

[Garden Girl]

Thanks,Rene !
I tried several times - now my email isn't visible.

Pina, you are very welcome. That little icon is gone now.

[DragonLady]

Somewhere along the line one of the settings got tweaked that shouldn't have.

No one's email address should be visible to anyone except themselves, the mods and the admins (in case we need to contact you for some reason).

But for some people they have been made visible, which should never happen.  I can only guess it's a side effect of all the changes and tests we've been doing trying to mend the other bugs.

But now I have to find this one, and I'm looking.... In the meantime, I implore everyone to go to your profiles and manually tick the box to hide your email.  That *should* make it invisible.

It shouldn't be necessary, and I'm sorry this has happened. 

[DragonLady]

Okay; it's partly fixed.

The email icons still appear, as well as the option to send an email to a member.

However, only YOUR email address will be shown, with a link to the profile of the email recipient.

I'd prefer to disable the email option altogether, but apparently the board doesn't allow that anymore.  I'll talk to the SMF folks and see if I can get a patch to remove it.

In the meantime: I really want to discourage sending emails through the board.  Private messages are a much better option.

As to the drama today:

Pina, as far as I can tell, the email you received did not come through the SG forum, or from anywhere else on this site.  It was sent from another website, or through a private email client.

Everyone: if you receive an email -or a private message- from a forum member that contains odd text or an iffy link, please do not copy-n-paste said link or said text into another message here.  If you want to verify if a message came from a user, just ask "did you try to contact me via ___" without including other details.  That way, there's much less risk of accidentally spreading malware through our system.

Finally: if someone sends you an abusive message of any kind through the SG system, just report it to the moderators.

[DragonLady]

Oh...one more thing:

In your profile, under "account settings" there is a line that says "Allow users to email me" with a checkbox next to it.

I strongly advise everyone to remove the check from the box, which I believe is on by default. 

It's your call, ultimately, but as admin I really believe private messages are a better way to communicate on the board, unless you really feel you know and trust someone.

[Pina]

As to the drama today:
Pina, as far as I can tell, the email you received did not come through the SG forum, or from anywhere else on this site.  It was sent from another website, or through a private email client.

DL,I agree ! 

My first comments............

On Sunday I received an email from a Stitcher's Guild member with her first and surname under a link in the email . I opened it and wondered why the member sent me an article by Stephen William Hawking. After I replied to the member's email - it was returned

Then I sent the member a PM asking - if it was her email address or if it was hacked and included the non malware news links only for information. She assumes I sent her malware/virus.

Yesterday I tried the link again - no malware - there was another article on that site,not Stephen William Hawking.

[DragonLady]

Every few months I suddenly  receive an email from a friend who killed herself years ago.

I catch my breath and feel a bit dizzy every time.

But it's just spam, sent by someone out there who obviously has no respect for anyone, anywhere.  It's always just a bunch of nonsense words and a link to something-or-other.

The first couple times it happened, I thought they were from her family.   So I would sit there trying to make sense of it, and I think I might have replied to the first one.  It seemed like some kind of cruel joke or something.

Spammers will go to great lengths to get us to read their emails or follow their links, and sometimes they can cause real trouble.  The only good news is that most of the time they're just selling something, and the trail ends at an unsecured shopping cart on a server parked on the back of a truck somewhere.

[Pina]

A couple of minutes ago I received another email supposedly from a very dear to me! SG member. This time I happen to know the email address in that email is not my dear SG member's email address !

As soon as let my dear friend know that someone else is faking her name I will delete the email. And  -  I don't have to use a SG PM to inform my friend that someone else is using her name.       I also know that Yahoo had more than only one security problem in the past.

I have no idea if other email providers had or have security problems. My reason for posting here to let other SG members know it is important to change passwords. 

[DragonLady]

A couple of minutes ago I received another email supposedly from a very dear to me! SG member. This time I happen to know the email address in that email is not my dear SG member's email address !

As soon as let my dear friend know that someone else is faking her name I will delete the email. And  -  I don't have to use a SG PM to inform my friend that someone else is using her name.       I also know that Yahoo had more than one security problems in the past.

I have no idea if other email providers had or have security problems. My reason for posting here to let other SG members know it is important to change passwords. 

(sigh)

The right name, but the wrong email address?

Sounds like a computer system trying thousands of different combinations in the hopes someone will helpfully provide them with the right information.

[Pina]

(sigh)

The right name, but the wrong email address?

Sounds like a computer system trying thousands of different combinations in the hopes someone will helpfully provide them with the right information.

DL,yes and not quite. 

My email address and name and - the SG member's name on Classic SG under a link. The sender's email address is not the SG member's email address ! 

I informed my dear friend and have to leave now,I will copy and paste the link later in my browser. I traced the last sender's email address after my previous comments here. I agree with you ............

Sounds like a computer system trying thousands of different combinations in the hopes someone will helpfully provide them with the right information.