Are Private Messages REALLY Private?

[CenTexPatriot]

I am using SMF v2.0.9...

When I receive an email notification from the forum regarding a PM, the email address "From" field shows as the email address of the forum administrator.

Is the forum administrator receiving copies of my private messages? Is this a relay of some sort? How does this work?

Any information would be most helpful.

Thanks in advance!

[margarett]

This is really a tricky question.

How private are PMs? It depends on a buch of factors, really.

First of all, PMs are stored in the database. Although SMF does not offer any way to easily check them via admin panel (eg, we don't accept MODs to do this), they are still stored in the database in plain text. Any admin that has database access and wants to see your PMs, he can.

Then, there's the report PM functionality. If someone reports a PM, admins will get a copy of it (of course, how could they check the report if they don't see the content? )

Finally, there's the "PM flow via email". What you mention is not a problem. All emails have to be sent from someone, so SMF uses the "webmaster's email address) as the "from". And from this point alone, there is no privacy issue.
This issue does exist when a forum is configured to use SMTP to send emails. If the admin uses, eg, gmail to send SMF's emails, this means that every "sent" email from the forum (PM or otherwise) WILL be stored in the "Sent Items" folder of the user in gmail. I don't think that there's a way to prevent this, it's how gmail works...

In short: if you don't receive email notifications from your PMs, neither do your "recipients", you are mostly private, except from the direct database access.

Do note that this is not specific to SMF. AFAIK, it's how ALL forum softwares work...

[a10]

Is the forum administrator receiving copies of my private messages?

Not if using PHP default, but the following errors occurs now and then on my forum (which discloses some PM content (to admin):

1: The 'not-so-awake' member writes a reply to the notification email and hit send, instead of logging in to the forum to do the PM work. Ends up in the forum admin email inbox.
2: The PM notification email bounces back to sender (forum admin) due to some error with the intended members email.

Am providing a guide for PM use, basically telling members to never PM anything that would not tolerate beeing seen in plain daylight, & that the general forum rules for conduct\content applies to PM as well.

[CenTexPatriot]

Thank you both so much!

Very helpful.

[aegersz]

i wrote a simple php script to dump the message database


marg edit: As stated, we don't endorse any way of reading members PMs. So please don't brag about it