4

Today I got a notification about a user that try to access a Private (moderator only) room, the room served its propose long time ago, it's now frozen (and deleted), but it surprised me that someone was able to request permissions for the room.

Is this a desired behavior? Shouldn't Private rooms be really private and only shown to those that know about it?

  • Requesting permissions to access the room isn't the same as being able to see what's in it. Got a link to the room? (You can email it to me if you'd rather keep it private. The email address is in my profile.) – Adam Lear Mar 31 '14 at 6:47
6

Shouldn't Private rooms be privated and only shown to those that know about it?

They are. All that the user sees when requesting /rooms/123 is that there is some room with this id. Until actually given access, that's all they know.

And this fact isn't really a secret, since the room id is just an auto-incrementing integer. If there's a room with the id 124, then there's also a room with the id 123.

Thus if there's a public room with the id 124 and a private room with the id 123, showing you a "request access" screen instead of "page not found" does not disclose any new information.

This is all the user sees in such a case:

screenshot of the access request page

  • Well, the name itself might be sensitive (extreme example being "Joe loves Jasmine") so won't it be better to just not show those rooms? – Shadow The Princess Wizard Mar 31 '14 at 7:27
  • 1
    @ShadowWizard What makes you think that the room names (or "those rooms", whatever you mean by that) are displayed? Apart from the standard chat site template, this is all they see. – balpha Mar 31 '14 at 7:32
  • Oops, I got confused with Gallery, the lock icon always made me think of privacy so now I gave it a better look and saw my mistake. So private rooms are moderato only feature? Can't see any way to create a private room myself. – Shadow The Princess Wizard Mar 31 '14 at 7:37
  • Yeah, that's for moderators only. And explicitly for moderation purposes only, too (we don't allow mods to use this feature so they can have a private chat hangout with a friend). – balpha Mar 31 '14 at 7:39
  • 1
    Thanks balpha, learned some new things today! – Shadow The Princess Wizard Mar 31 '14 at 7:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .