This was going to be put in the 'anonymous poster' thread, but I figured I would put it here instead:
Caveat: I do not use vbulletin, so what I say here only applies
strictly speaking to Invision Power Board. However, it applies more generally to this and other message boards as well, and all websites that store your information more generally than that.
All moderators on my board can access the following 'semipublic' information:
- A user's full login name (if it differs from his display name)
- A user's actual email address
- A user's IP address, and any other IP addresses that user has used
As an administrator, I can access the following 'private' information:
- Read people's Personal Messages
- Read people's blog entries (be they private or not)
- Read email sent through the 'email this member' board function
- Read and recover deleted posts
- Read and revert posts to previous edits
Now, it is not convenient for me to do any of this administrative 'snooping'...it involves doing MySQL lookups on the raw database. My users are aware this 'snooping' is possible, and I have used it to resolve potential legal (and board) disputes.
The only thing that almost all board packages (and websites in general, by now) handle securely is passwords. I cannot access your password, as it is hashed, I can only reset it.
Is anyone surprised that this is possible? I would hope not...operating with the assumption of privacy online is a good way to get a nasty surprise.
Can any staff here confirm or deny that vbulletin is similar? Even if everything were hashed and stored securely, instead of stored plain text/gzipped (very unlikely), anyone with both the server FTP password and an admin login could just copy the whole board onto an offline test environment, reset your password, and log in as you, getting all the access you have without alerting you that someone has changed your password.
Can any IT staff confirm or deny their ability to access supposed 'private' data? For example, I know our IT department can easily read the email of anyone with a blackberry, but it requires logging in as someone to read regular user's.