Topic: Monitoring individual IP addresses' activity

[SomeoneElse]

I've just moved an SMF board from one server to another and gone from 2.0.13 to 2.0.15 via doing a clean install of 2.0.15 on the new server.

One of the mods is asking me what happened to the ability of a mod to see what posts, profiles etc an IP addresses is looking at via looking at their profile, down to being able to see who they were PMing. ("It would say something like 'sending PM' and then the user account number.")

My guess is that this was done via a mod, but a) I can't see any obvious candidates in the mod files that the old server had, and b) can't find anything like this in the list available for 2.0.15.

[GigaWatt]

Admin --> Members --> Permissions --> General Permissions --> Moderator --> Modify

[SomeoneElse]

Oops, I should have said 'Administrator' - that's their user type - and they have permission to do anything that's doable.

[Kindred]

you can't see what they are DOING by IP - and never have been able to, AFAIK.

You can see the accounts which have used that IP and the posts which have been made by that IP...  but you have never been able to -- and never will be able to -- see "user is sending a message to user 1234. *THAT* is a violation of privacy that SMF will not ever permit in an approved mod.

[SomeoneElse]

Ah ha!

It was from Tracking User Activity - https://www.simplemachines.org/community/index.php?topic=36793.0

You can see the accounts which have used that IP and the posts which have been made by that IP...  but you have never been able to -- and never will be able to -- see "user is sending a message to user 1234. *THAT* is a violation of privacy that SMF will not ever permit in an approved mod.

I can get that seeing the content of PMs would be dubious, but being able to see that someone who needs to be watched is PMing various people is legitimately useful. (Offline, we accept that the Post Office can see who you're mailing, without knowing what's in the envelope... )

Are PMs encrypted in the database? I had the impression that they were not and so anyone with database access can see them.

[Kindred]

well, you might find it useful -- but it is not something that SMF will ever encourage and will actually, actively discourage.

[GigaWatt]

Are PMs encrypted in the database? I had the impression that they were not and so anyone with database access can see them.

Yeah, I think they're not encrypted.

"Writing a PM" is not enough info for you? Because I think that that's an out of the box feature in SMF.

[Aleksi "Lex" Kilpinen]

Are PMs encrypted in the database? I had the impression that they were not and so anyone with database access can see them.

Yeah, I think they're not encrypted.

"Writing a PM" is not enough info for you? Because I think that that's an out of the box feature in SMF.

I think this is as close as it gets with SMF for now https://custom.simplemachines.org/mods/index.php?mod=2426
Not encrypted, but lightly encoded. The PMs are not in an easy to follow format in the database by default either, but this makes it just a little more difficult for those would just go around digging for private discussions in the database.

[GigaWatt]

Let's be honest... if I really wanted to read PMs from members, I could... anybody with the right tools and knowledge could. But that's not the point. The point is that even though you're an admin, that doesn't give you the right to do that.

I'm with Kindred and Lex on this one. I'm an admin and even though in some cases I know that members shared some things, links, whatever, through private messages, things they shouldn't have shared, I never looked at their PMs... and never wanted to. There are a lot of other ways to get to the bottom of things if you're suspecting your members or your staff are doing something behind your back .

[SomeoneElse]

To be clear, I (and the person asking) are not asking to be able to read PMs. But I would say that it's not unreasonable to know that someone you already think needs watching is PMing, say, a particular user.

Not everyone reports harassment but if A is PMing B ten times a day on a board I'm responsible for and not getting any replies, I'd quite like to know.

[Kindred]

Honestly, yes, I think it is too much.

If the user has an isdsue with another user harassing them, then they have the "report to admin" option within the PM itself.

[GigaWatt]

Not everyone reports harassment but if A is PMing B ten times a day on a board I'm responsible for and not getting any replies, I'd quite like to know.

Well that's their choice, right? That's why the "Report to Moderator/Admin" option is there. If someone is harassing me on the street, I'd report them to the authorities, right? The same thing goes here. You're not to blame if this person doesn't have basic survival instincts .