impersonating users
-
I think administrators should have the ability to impersonate users. In some cases this is needed. This feature is available in software such as Discourse, Flarum. Why not on NodeBB?
-
@kurulumu-net Agree. Flarum has this also, and I in fact have a use case for exactly that right now
-
I am opposed to admins being able to impersonate forum users. Admittedly there may be legitimate use cases for such. e.g. a buddy of mine emailed me a story he'd like posted but does not want to post themselves. Ideally I would want them to get the "credit" for the post so rather than posting under my account might "impersonate them", a'la su - forum style, just long enough to post as their imposter. But alas, as tempting as this may be, there is also too much temptation for abuse.
And I think it violates a social contract trust. Or will we need to implement signed hash's to confirm that a message/post is really us? Even the faintest perception of such becoming necessary really damages community building. Nah, the minor amount of convenience to be gained is not worth the potential for mis/abuse.
-
@gotwf I understand the points raised here, and would agree. My thoughts around impersonation" would be to troubleshoot user logins etc, and not to be able to post as the user. There should be controls in place that address this behaviour.
However, you can easily create a post as yourself and then change the author without having to impersonate the user.
-
Well, I guess some new features for me to look forward to if I ever get around to updating.... When was this introduced, eh?
-
In and of itself I have no objection to this feature. Given that admins have control over all aspects of a running forum already, it doesn't seem like a violation of user trust if they were allowed to read user PMs.
That said, I do see how it could be a surprise if a user were to learn about this ability of the admins. We could always just disallow reading chat messages when sudo'ing
-
@julian I think there should be some sort of triggered notification to a user when an admin impersonates them at the very least.
Or in some cases, a push notification message that needs to be approved before an admin can login. However, there may be cases when you want to get to a user who has been abusing the system, and therefore an override should be possible.
Just some ideas.
-
It would seem we are conflating two different things here:
-
The ability for admins to post as other community members.
-
The ability for admins to spy on community members' private chat messages.
I am opposed to the first. Editing? Maybe. But starting threads, posting replies, and possibly pm's as another site users? I do not really see much of a use case for this while I do see the potential for a huge abuse case.
Regarding the second, while it would be nice if otherwise well meaning site administrators did not require such, I am fine with administrator access to private chat messages. Discounting any potential legal cans of worms. TOS and such would need to be worded congruently.
-
-
With private messaging, there may be situations where it is necessary to see a member's messages. For example, in case of an unlawful situation in the past conversation between two members, the judge may request the recordings of the conversation in the court case to be opened. In this case, the site administrator does not have the right not to grant it, at least in our country.
-
The question you need to ask yourself is why you would like to impersonate a user?
- list itemIs it because you want to recreate an error the user has? Just ask him if you can logon to his account and temporarily change his password to do so. You don't need any additional plugins to do this and the user knows you are accessing his account.
- Do you want to read his private messages? Why would you do this? Here (in Belgium) it's illegal. For two reasons :
** it's considered as private information and thus you're not allowed to read it. It's simply illegal.
**Another reason is GDPR : you only can access user information if it's relevant to do so and only for the duration that it's relevant. No way you can justify reading his private messages.
In case of abuse or more serious illegal activity by the user, let's say he/she's trolling other members, you'll get this information from other concerned users and can act according to this information. It's your perogative as administrator to ban users based on their behaviour on your website.
And if the user really does illegal stuff like insinuating or distributing child pornography (I know heavy example), you're legally obliged to report this to the authorities. Not doing so makes you an accomplice, at least here in Belgium.So in my book, there's no reason at all to impersonate a user. And if anybody reports abuse and provides the necessary proof, I'll act according to the forum's rules and if needed according to the Belgian law.
