Are we members at risk for hacking?

13

Comments

  • nihahi
    nihahi Member Posts: 3,841
    edited December 2016

    Could that Mod comment be posted here, so we all know what was said???

  • BarredOwl
    BarredOwl Member Posts: 2,433
    edited December 2016

    I believe this is the post from yesterday by the Moderators which was mentioned above by MinusTwo. Their reply is probably best understood in the context of the original post.

    https://community.breastcancer.org/forum/93/topics/851039?page=1#post_4858870

    BarredOwl

  • MinusTwo
    MinusTwo Member Posts: 16,634
    edited December 2016

    Thanks Barred Owl. I should have put the link.

  • nihahi
    nihahi Member Posts: 3,841
    edited December 2016

    Excellent response, Mods.....thank you.


  • ceanna
    ceanna Member Posts: 5,270
    edited December 2016

    I've been curious and have asked before on the privacy thread, but received no answer, about all the many "members" in the Members List who have no "postings" and no "topics" and haven't been "seen" in many years--sometimes as long as 12 plus years. I doubt they have been "lurking" all this time. Do all those seemingly false accounts increase our risks for hacking on the threads?

    Why does BCO keep those accounts on the rolls other than to inflate the number of supposed members for marketing purposes? Do the current "hackers" accounts being discussed here remain on the rolls or are they deleted immediately and totally? Whenever I've needed to search the member list for someone, I'm always quite amazed that it looks like, at most, only one in ten "names" listed are active in the last 4-5 years. That means the number of active members is closer to 18,000 than 180,000. Sounds like it is past time to clean up the database of members to those who are active within a generous period of time--say 3-5 years, or email these inactive members to warn them that they might be dropped--then drop them if they do not reply or the email comes back as "undeliverable." Love to hear back on how these inactive accounts affect our risk.

  • Anonymous
    Anonymous Member Posts: 1,376
    edited December 2016
    https://community.breastcancer.org/forum/93/topics/844776?page=8

    ceanna, on page 8 about a third the way down Mods posted the following, and my reply is below that with some screenshots

    Quote:
    Musical, what do you mean by this?

    "Having mentioned it a few times earlier I was going to post about old accounts that have zero posts plus the spam with web addresses in their titles... numerous lately. I look forward to your reports."


    In the topics? We try to delete it as fast as possible, deleting the member and account. Please let us know and we'll delete them immediately. Spammers are so annoying!

    Unquote

    If these are still there I am left wondering why these haven't been purged. I do share your concerns.

    That said, because BCO is encrypted (as in https and the "s" means secure) it will be a LOT harder for your account to be hacked, and that translates into its members not being hacked, so accounts are pretty safe unless you gave another member a password or something, which is forbidden of course and I can't imagine anyone doing that. If you had a trojan keylogger on your computer then your account can be hacked that way (not only pertinent to BCO, but anywhere you log in, like your bank or another forum for example.) The other way as far as BCO is concerned is, as has been discussed, clicking on a bad link at BCO which MIGHT give you something nasty.
  • nihahi
    nihahi Member Posts: 3,841
    edited December 2016

    I reported a post this morning.....NO EMAIL DELUGE!!!!!. Thanks Mods!

  • ceanna
    ceanna Member Posts: 5,270
    edited December 2016

    Musical, I doubt these unused accounts are from spammers. They appear to be accounts created and never used many, many years ago. I'm speculating BCO keeps these accounts to claim higher member numbers for fund raising purposes. The number of unused, never used accounts over 4-5 years old appears to be greater than the number of active members and BCO needs to do a little purging of very old, never active accounts to provide a more realistic member number.

    BCO mods, what are actual numbers of active members?

  • muska
    muska Member Posts: 1,195
    edited December 2016

    Speaking of unused accounts all public forums and boards have many. People register but don't necessarily use them. Sadly, a high number of old accounts on breastcancer.org may be explained by deaths from BC. Also, many frequent this site soon after diagnosis and during active treatment and then move on. The latter is actually quite healthy but it doesn't mean they necessarily need to be cut off. and their accounts deleted.

  • Traveltext
    Traveltext Member Posts: 2,089
    edited December 2016

    Muska, you've stated the obvious and that's the reason BCO would be loathe to just delete an account through inactivity. Also, because bc can recur 5, 10, 20 years later, people would come back and expect their accounts to be there. In addition, there are lots of lurkers coming in at times to look and learn. If they decide to make comment, they can. I certainly don't think BCO is just trying to "claim higher member numbers for fund raising purposes". Why on earth would this be so?


  • MinusTwo
    MinusTwo Member Posts: 16,634
    edited December 2016

    I have two thoughts about the unused accounts - both agree with Muska & Traveltext. I do get more cynical as I get older, but I really think BCO is doing a marvelous job. They are on my good list and not my suspicious list (and believe me my suspicious list gets longer & longer)

    Many people come just to read. I was a lurker for a long time before I jumped in, and some people will never post. I hope they feel welcome. I would not want to see them deleted.

    Personally I dropped out after my first bout with cancer, but was sure glad that my account was still there when I had a recurrence. You never know when you might need to check back - even if it's for something like the onset of LE years after treatment instead of an actual recurrence. Or osteoporosis. I can't see that it hurts anyone to let the accounts rest until they are needed again.

  • BarredOwl
    BarredOwl Member Posts: 2,433
    edited December 2016

    Having an account can be quite beneficial to those who do not post. For example, you can select preferences about articles from the main site, add threads to your favorites, and block threads, forums, or members for various reasons. Some people may no longer post, but may use the PM function.

    BarredOwl

  • ceanna
    ceanna Member Posts: 5,270
    edited December 2016

    Just to clarify, I am not suggesting long term members be deleted if they haven't posted or "viewed" lately or if they've set up preferences or favorite topics. I'm talking about people who haven't had any "recent activity" or used their accounts EVER. Maybe they just thought they had to create an account to lurk--which no one needs do.

    In just two random pages from the "Member List" available in the blues tabs in the left hand column, I could have copied at least 18 examples. They have no activity ever or haven't been "seen" since the day they created an account. I'll give you 3 without showing the member name as an illustration of those I think are accounts the mods should purge:

    image

    image

    image

    I, too, think the mods do a good job. The database of membership just needs to be cleaned up.

  • muska
    muska Member Posts: 1,195
    edited December 2016
    Hi Ceanna, basically you are suggesting members be deleted due to inactivity. May I ask why? This is not going to reduce spamming that should be taken care of by technical means, not by deleting inactive users. These inactive users should not be slowing the database performance because the database is fairly small (I recall seeing 180K number for users somewhere.)
  • Anonymous
    Anonymous Member Posts: 1,376
    edited December 2016
    It is not unreasonable or unheard of for a site to purge very old unused accounts especially where there's been zero posts. BCO would know by logs whether these people were utilizing the board in other ways. In any case, since these account holders have never posted anything, there's nothing to lose by simply making another account if need be. I can't see the big deal about doing that.

    Ceanna, I was mainly answering your question and how it was unlikely to be hacked in relation to your first paragraph. I doubt they are spammers also. To reflect that, I've bolded the relevant part in my previous post.

    As to the zero posts, I wouldn't rule out that your "speculative" thoughts have substance, that it's boosting numbers. It's possible and therefore you can't rule it out. As far as trust goes, in such a setting as the internet, where you typically DO NOT personally know people like MOds, admin etc, it's prudent to be cautious. I do not just blindly trust.

    I said (from the link) ....

    "Regarding the old accounts with zero posts - I clicked on "member list" in the left panel > the first page has 50 entries, 32 of which are zero topics zero posts."

    This proportion of zero posts I think is remarkable. Going by the first page, well over 50% of people have made accounts and never used them. Have a look at my sample screenshot. What is creepy is these type of accounts can be made to see more private information such as in members' profiles, than if they never signed up. Personally I think this board should be tightened up so that it doesn't include just anybody. As has been mentioned by some, I hope BCO instantiates some sort of post limit for newbies.

    Edit: Ceanna I was posting this and so missed your last post. Thanks for your sample.

    Edit #2 well interestingly your last 2 entries reflect the same "last seen" date as the "member since" date. That means they would not have used their accounts from that point on and thus not utilized other board features such as PMs.
  • Beesie
    Beesie Member Posts: 12,240
    edited December 2016

    Mods, great change to not allow live links/URLs in newbies posts. However links are still allowed in newbies signature lines, so that is where the spammers are now putting their links.

    I just reported 6 spam posts that were set up this way. Oops... as soon as I finished this post 5 more similar spam posts showed up. Just reported those too. Thank you for simplifying the reporting process


  • MinusTwo
    MinusTwo Member Posts: 16,634
    edited December 2016

    Mods - I thought I understood that newbies were not going to be allowed to start theads. Yes, read & post on existing threads, but not start new threads at the drop of a hat. Maybe I just missed seeing this before but i am seeing tons of new people starting one thread after another telling long stories and asking for help. I'm beginning to feel like some of these new posters are just putting us on.

    What did you determine about the length of time someone needs to be a member before they can start a new thread???

  • muska
    muska Member Posts: 1,195
    edited December 2016

    Well, If I couldn't start a new thread because of being a newbie I wouldn't be back to this site again.


  • Beesie
    Beesie Member Posts: 12,240
    edited December 2016

    MinusTwo, I don't recall that being part of the changes. As much as I want to eliminate spam and as much as I believe that there needs to be more control over newbies' posts (so that an anxious newbie can't start a half dozen threads within her first few hours on the board), I don't think it's realistic or practical to stop newbies from starting at least one new thread. Newbies come here because they have a specific concern related to their breasts or breast cancer; for this board to serve it's purpose, they need to be able to start a thread that states their concerns and asks whatever questions they have.

    What I recall about the changesis that newbies wouldn't be allowed to include links/URLs in their posts. But as per my post a couple of days ago, the spammers have already found a way around that, by including the link in their signature line.

  • MinusTwo
    MinusTwo Member Posts: 16,634
    edited December 2016

    Bessie: Thanks for the recall. I like your sentence about some control (so that an anxious newbie can't start a half dozen threads within her first few hours on the board). I was specifically referring to a newbie who started 6 new theads in just a couple days. And another that started 3 new threads. Each thread told a long story and asked for help. The details were the same with enough differences in each thread that I began to wonder if the story was made up. The thoughts & answers & & advice & hopeful wishes from seasoned members were ignored, even when several members pointed out that following up with one thread would make it easier for us to understand what was happening.

    I do believe BCO needs to be here for comfort as well as information & education & friendship & support. Maybe I was just questioning the veracity of this proliferation & duplication of involved stories with no profile information, and how it would affect the other new members who are scared. And maybe it's a generational thing. I don't always succeed, but I try to look before I leap - or post, as the case may be.

  • MelissaDallas
    MelissaDallas Member Posts: 7,268
    edited December 2016

    I wish they could be limited to starting one new thread until their diagnostics are resolved, but I don't know how that could be done. I don't care how many they comment on, unless they are stirring up unnecessary hysteria with the "this is so scary and we're all going to die from our cysts" BS among other undiagnosed new members.

  • lintrollerderby
    lintrollerderby Member Posts: 483
    edited December 2016

    I agree that newbies should be allowed to start a new thread, but I think it should be limited in number, like Melissa mentions. Perhaps one or two, but no more--but I also don't know the practicalities of implementing that. Mods: what are your thoughts on this and if it's something you agree to, is it a possibility on the software end of things? If at least one new thread per newbie isn't allowed, then we run into the issue of hijacking posts to bring up their concerns.

    It's not uncommon to see a newcomer post an introductory thread about how scared they are (understandably), but then it becomes evident when they've started reading more BC-related info and begin posting speculation of outcome (both good and bad) on each other's posts. Somehow, they can apply that new information to each other's circumstances but not to their own.

    As for the spammers finding a work-around and using the signature area for links, is it a possibility to restrict that ability to established posters--say 25 or some other number that seems appropriate? I don't know if that's even a possibility, but I know of other forums that won't allow the profile information area to link to an offsite url (blog, etc) until you've reached a pre-determined number of posts.

  • cive
    cive Member Posts: 709
    edited December 2016

    I don't see why you need to worry about links anywhere but in the thread topic - just don't click on them. I never had a problem even in the thread topic, since I recognize a link and don't click on it. What is the business about "diagnostics are resolved"? That it shows or what? Notice you don't see mine (for the very reason of this thread topic) and I am not a newbie. I just don't see a need to share my health information with others.

  • pupmom
    pupmom Member Posts: 5,068
    edited December 2016

    Cive, how is a newbie supposed to know what is spam, or not, from the thread title? Before I figured out what was going on, I clicked on many of those threads. Might have even clicked on a link or two, which may have compromised my computer. This is NOT acceptable from a reputable web site.

  • Moderators
    Moderators Member Posts: 25,912
    edited December 2016

    We are looking into not allowing new members to post links in their signature line! Also, they may not have a link in their topic title. Very sneaky, these spammers. Also, considering limiting new member's number of posts! Thanks for your input!

  • nihahi
    nihahi Member Posts: 3,841
    edited December 2016

    Thanks Mods...re: spammers. The limiting number of posts is a tricky one.


  • lintrollerderby
    lintrollerderby Member Posts: 483
    edited December 2016

    cive: Not true. Spam links that could lead to either harmful or junk sites should not be allowable in ANY part of a post. It's not just about knowing not to click on the link, but it gives the forum the appearance of unprofessionalism just by their presence. Also, people can accidentally click on a link while scrolling. Spam links should not be allowed anywhere on this board.

    Not to speak for Melissa, but the business about "diagnostics are resolved" has to do with the concern over new members without a diagnosis who are worried, starting a bunch of new posts before they've been given a diagnosis. Some of us feel that new members who have not been given a diagnosis (either that their concerns are benign or malignant) should not be able to start repetitive threads voicing the same issue because it clutters the board, makes their concerns difficult to follow and give advice/offer support, and can whip up frenzy in frightened newcomers.
  • lintrollerderby
    lintrollerderby Member Posts: 483
    edited December 2016
  • lintrollerderby
    lintrollerderby Member Posts: 483
    edited December 2016
  • MinusTwo
    MinusTwo Member Posts: 16,634
    edited December 2016

    Mods - thanks for me too.

Categories