13

In Chat, if you delete a message, and then paste a permalink to that message, the onebox will show the full content of the "deleted" message. This works for non-moderators (verified on chat.SO).

revealed deleted chat message

It's possible to get the message ID of a deleted message by using the web inspector to check its element ID, so you can therefore construct the permalink for any deleted message and view its contents by this message.

As moderators we often remove content when it has personally identifiable information or otherwise must be removed; this circumvents the ability to remove posts. To fully remove a chat post, you would have to edit its content to be empty, then purge its history, then delete it. Once it's been deleted you can't edit it, so any deleted message that wasn't edit-purge-deleted is permanently accessible.

  • To that end I still don't get why the purge history leaves the latest revision visible without any option to have it do otherwise. – Tim Stone Jun 3 '15 at 5:52
  • Trivia: you can edit deleted messages. Ask me why I had to know this... – Shog9 Jun 3 '15 at 5:54
  • @TimStone Pardon my lack of understanding how chat works on a regular basis, but... what do you mean by "purge history"? – Adam Lear Jun 3 '15 at 5:54
  • @AnnaLear That button under "Message History". Pressing it clears the bits at the bottom but the rendered message at the top remains afterward. So you have to edit the message to say something else then purge the history, in cases where the latest revision was what needed to be purged. (post-purge example) – Tim Stone Jun 3 '15 at 5:58
  • @Shog9 Huh, indeed. I thought I had tried that before and it didn't work. Or maybe it did work and I'm just now doubting myself. Seems likely. – Tim Stone Jun 3 '15 at 6:01
  • @TimStone Huh, interesting. In principle, I'd argue that "purge history" does literally what it says on the tin - it doesn't say "purge message" and it ain't history until you got back at least one message... But this is a weird argument to make. A lot of our chat moderation tools need work. – Adam Lear Jun 3 '15 at 6:03
  • @AnnaLear Yeah, I've always taken it as balpha "Technically…"-trolling us, but despite that it's probably not the most useful behaviour. There's unfortunately a number of things in chat that I'd be super stoked to see fixed since they're low-hanging fruit, but also hard to justify priority-wise :( – Tim Stone Jun 3 '15 at 6:06
  • 1
    @TimStone I bet a number of them are low-hanging because nobody knows they exist and therefore wouldn't miss whatever the current behaviour is... ;) – Adam Lear Jun 3 '15 at 6:12
  • @Shog9 OK I'll ask... why did you have to know this? And uh... how? – nhinkle Jun 3 '15 at 7:58
  • @AnnaLear You mean we're not complaining loud enough about chat? I think we can change that ;-) – Mad Scientist Jun 3 '15 at 13:49
  • Because Josh Gitlin, @nhinkle. – Shog9 Jun 3 '15 at 20:05
6

In general, the oneboxing will work in every case where the person posting the message permalink has access to the message's content. So, say, if you, in a public room, post a permalink to a message in a non-public room that you have access to, it will onebox (the reasoning being that you might as well copy & paste the content). This even works across chat sites (e.g. a message in a moderator room on chat.SE, posted into the Tavern on chat.MSE). So this isn't really a security or privacy issue.

However you're absolutely correct that it makes no sense in this case. A deleted message has no "content" anymore that could be oneboxed. Yes, it still has a history and you may have access to it, but there is no message history oneboxing, only message content oneboxing.

From the next build on, deleted messages won't be oneboxed anymore, in any case.

6

This is possible, but you should not worry that people can view your deleted messages: it only works when you can actually see the content (here you can see the testing I did). As the message poster, you can see the history, so you can onebox the message. I, as a room owner of the Sandbox, can also see the history of a deleted message, so I can onebox it. But when my chatbot account tries to onebox it, it fails, because it cannot see the original message content.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .