Privacy Concerns, Can Administrators and Mods Access Personal Messages?

[TryNinja]

(although I don't have direct knowledge of the first claim, that Theymos has access to everything; you should just assume it to be true for security's sake).

Doesn’t he have access to the forum’s server backend? He’s the one coding or adding patches to the forum: April fool’s pranks, merit system, etc…. Access to the server = full access to every single byte of data and how the forum behaves.

Also, remember that theymos being a privacy advocate doesn’t mean you shouldn’t be cautious. He already shared PMs for a subpoena: https://bitcointalk.org/index.php?topic=1027518.0

[1714259466]

1714259466

[1714259466]

1714259466

[1714259466]

1714259466

[1714259466]

1714259466

[hugeblack]

Several years ago there was a proposal to publish Satoshi's private messages, but after a while this idea was stopped, so all data from day1 is recorded.

Also, remember that theymos being a privacy advocate doesn’t mean you shouldn’t be cautious. He already shared PMs for a subpoena: https://bitcointalk.org/index.php?topic=1027518.0

Does anyone know the amount of data that was requested regarding CM. Bitcointalk was mentioned several times in that report, but I don't know whether they relied on the data available to everyone, or asked for IP addresses and private messages.

[Lucius]

Does anyone know the amount of data that was requested regarding CM. Bitcointalk was mentioned several times in that report, but I don't know whether they relied on the data available to everyone, or asked for IP addresses and private messages.

This information can only be known by the admin, and I am not aware that he has commented on anything related to CM. In the event that someone's personal messages or other private data are given to third parties at their request, those forum members should be notified. Of course, if something has not changed in this regard compared to 2015 (I am referring to the link posted by @TryNinja).

[virasog]

What informations do you really have to convey through PM's that doesn't warranty the admin's solicitude?? BTC deals that the forum doesn't have? Ponzis that nobody has never heard of?? Sexuality and sensitivity?? Except these PM's are really concrete for encryptions, but then i see nothing wrong with that.
Theymos won't make users anonymity so discreet that he ain't got no details about it... afterall he controls the site itself...

Sandra 🧑‍🦰

Well, intelligent people may think out of the box and you never know some people might send the private key to themselves thinking that it is the safest place as no one can access the PM.   or more generous ones may send the private key or seed phrases to their friends through PM to keep them save. We just can't image what people's use cases for the PM.

No one realizes that once you upload, write or store anything on the internet, whether it's a personal email message or a personal drive, nothing is secure and private. The centralized company providing the services have access to each and everything that is stored on their servers.

[light_warrior]

So this has been discussed many times already. You could just use the Meta search to find the answers to your questions. theymos has already answered this kind of questions.

A limited number of people can read the personal messages. Personal messages are stored in the database in encrypted form and only those who have the decryption key can read them.

Only me, Gavin, Satoshi, and Sirius can decrypt it.

You can read this topic. It contains quotes from theymos on the subject.

"PM privacy is not guaranteed. Encrypt sensitive messages. "

[tranthidung]

The Privacy page clearly states that the forum has to obey the US.
so if government send forum admins kind of subpoena for a user's data including PMs, admins will have to fulfill such request.

Variation
Variation from the above normal procedure may occur, for example, due to these causes:

    Bitcointalk.org is in US jurisdiction, and is subject to US subpoenas, wiretap orders, preservation orders (which would negate the above retention rules), and similar. Furthermore, our service providers could also be subject to similar orders without our knowledge. Note that we consider PMs to require a warrant in order to be released.
    At our sole discretion, we may voluntarily assist law enforcement worldwide. Generally we do this only when we perceive that the target user has probably committed a serious and non-victimless crime.
    At our sole discretion, we may (noncommercially) share or extend retention on any of a specific user's userdata even without law-enforcement involvement. This is very rare.
    While we don't intentionally set up systems to do so, data may end up laying around for longer than the above-specified retention limits accidentally. For example, a sysadmin might copy the access logs in order to analyze an ongoing DDoS attack and then forget to delete them for a while.
    Computer security can never be guaranteed.

It was done with Silk Road case years ago. I am not sure about CM case as no information about it from theymos.

By the way, by checking the page today, I noticed that theymos should edit its content as Wasabi wallet is still recommended to use. If theymos listened to community voice and excluded Ledger wallet, why he did not do the same with Wasabi wallet.

Use private payment technology such as the Wasabi wallet

[Stalker22]

I'm surprised nobody mention CloudFlare so far, which is used by this forum.
~

I'm surprised that you are surprised by this! 

~ there would still be a range of potential man-in-the-middle scenarios to worry about. Your local network administrator can intercept communication, as can your ISP, your VPN provider, CloudFlare, hosting provider, server administrators, ...

[dkbit98]

You can always encrypt all messages on your own and send them to other members, but they would need to have decrypting keys to read them.
If you want to share private confidential information you shouldn't use anything without encryption, but for casual talk it's fine to use forum messages and you shouldn't be concerned about that.
Note that not all encryption is made equal, and I don't consider telegram encryption is good.

[philipma1957]

Some of my PM's have been read by someone and released in a thread. YEARS AGO Say 2014 or 2015.

Pm's are not private. They can be looked at in more than one way by more than one person.

Don't use PM's if you don't want the info revealed.

The government can force them to be released.
A few can actually read them with no effort at all.
Your account or the account  you sent a pm to can be hacked.
This site was hacked at least once and some info was leaked.

and anyone that you sent a pm to may reveal it for good or bad reasons.

So if you want  privacy do not consider the pm to be failsafe.

[NotATether]

I'm surprised nobody mention CloudFlare so far, which is used by this forum. CloudFlare decrypt internet connection between you and Bitcointalk server for various reason (primarily for DDoS protection) which mean theoretically they could log and analyze data transmitted between you and Bitcointalk server.

They can't do that, because it's an HTTPS connection so all packets they collect will be encrypted with TLS 1.2 or similar. The certificate and private key is with Theymos as well, not with Cloudflare which only takes on your DNS and relays it to your server after filtering out bot traffic.

[Lucius]

~snip~
A limited number of people can read the personal messages. Personal messages are stored in the database in encrypted form and only those who have the decryption key can read them.

Given that my post, in which I stated, is another example of who can technically read PM, for those who do not read what others write and respond only to certain posts I will quote again. The post from 2012 is out of date anyway, unless Gavin still has the privilege of reading PMs, which would not only be illogical, but also dangerous since he's long gone to the dark side.

We don't log your IP address when the extension contacts our server but if you don't trust us you should use Tor or VPN. The extension can technically read any data from your BitcoinTalk session, including your PMs, but it doesn't do so. It collects user IDs from the page you're looking at - e.g. a list of posts in a thread - and sends that list of IDs to bpip.org to get info about those users, and only does so if you turn the optional features on (these features are off by default).

The extension works even if you browse BitcoinTalk.org without being logged in. The source code is not obfuscated and can be examined by anyone with sufficient JavaScript knowledge using developer tools built into most browsers. Same tools can also be used to check network traffic to/from the extension.

[hugeblack]

Only me, Gavin, Satoshi, and Sirius can decrypt it.

You can read this topic. It contains quotes from theymos on the subject.

This information is old, but it represents that the administrator and Global Moderator can read messages after decrypting them, or more precisely, this quote is better:

Global moderators can download the encrypted database backups. Admins and past admins (Gavin, Satoshi, Sirius, me, and now justmoon) can decrypt them -- they therefore have complete access to the database and can read PMs, etc. Justmoon and I can also query the live database.

In addition to the concerns reported by some about third-party applications and cloudflare.

BTW, There was an administrator called @Justmoon  he reminds me of suchmoon