[RESOLVED] Posting replies to Gear Swap listings may expose your email…

[YoPrawn]

I had someone I do not know from this site email me, directly to my email address from theirs. Kind of confused about that, I found that they saw my BPL-linked email address when I sent a reply to one of the Gear Swap posts they made. I wasn’t interested in the item, but making a comment about it.

Just saying that this could be considered by some to be a major breach of personal info to others without any consent or knowledge of this happening behind the scenes.

First of all, am I correct that one’s email address is revealed when replying to Gear Swap listings? Which seems logical on the surface, as PayPal needs emails, but this is still not OK.

Would it be possible to default this to NOT be true unless otherwise opted by the person posting?

Also, on top of revealing the email, one can then find more personal info from PayPal by giving the email address, assuming it is linked to a PayPal account. I think it is possible to get first and last name, at the least.

 

[Matthew / BPL]

I’ve done many, many deals on Gearswap and I’ve never seen the other party’s email address revealed until one of us asks the other for their PayPal address so money can be exchanged.

[YoPrawn]

If you post a comment on a Gear Swap it sends an email to the person who posted the Gear Swap. In that email is the Email Address of the person who commented.

I just verified this, as someone commented on my Gear Swap several hours ago. I now have their name and email address. Thankfully I am an honest person and will dispose of this info. :)

[YoPrawn]

Sorry, this pertains to the Commenting section on the Gear Swap, not the link to send them a PM. That may have confused a bit there.

[BlackHatGuy]

I brought this up months ago in the website issues forum, never heard anything else about it. It should be a known, albeit seemingly ignored, issue.

[Matthew / BPL]

I’m sorry it got lost when you reported before, RMB.

Johan, can you make a comment on this test post I just made please? https://backpackinglight.com/gear-swaps/just-testing/

[YoPrawn]

I’m not a programmer, but I’ve fiddled around with enough code in my life to know there is a good probability that such functionality could be commented out of the code without much risk. I think the intention is to automatically show email addresses for PayPal verifying, but not everyone would want that info disclosed just asking a question. And not everyone uses the same email for BPL as they do PayPal.

[Matthew / BPL]

Ok. I got the notification and I see what you mean. I will log this and report back.

[Matthew / BPL]

This has been marked as a priority for Dev team. I will update the thread as we get word on this. Thank you for bringing this to our attention.

[Matthew / BPL]

The issue has been resolved!

I just tested it with the test post from yesterday and I only get the member’s username, not their email address.

There is a lot of work going on behind the scenes right now. We are setting up lots of systems. One of those is the ability to communicate and track bugs and feature requests more effectively.

[YoPrawn]

Cool. I figured it must have been a super easy and low risk fix. Such things like this in code usually require some specific logic for displaying character strings, and is very unlikely a buggy byproduct of other systems, thus it probably just needed to be removed from the code logic, that would be pretty isolated from the rest, making it a safe fix.

I used to work as a video game designer, who created bugs and fixed bugs. It’s in my DNA to get mad at seeing bugs and then work to destroy them.

Our motto in the game industry is: “You gotta break S**T to make S**T.”

Or the song: “100 bugs of code in the queue, 100 bugs of code. You take one down, patch it around — 120 new bugs in the queue.”

[Author]

Posts