¿ªÔÆÌåÓý

  1. GroupManagersForum
  2. Topics

Member email address change on our group changed it on & notified another group

 

¿ªÔÆÌåÓý

Hello all,

?

One of our group members email addresses changed.

Notified of the change I was asked to modify their user account in our group.

?

5 hours later I received an email from a moderator of a totally unrelated group forwarding a message that [My name & email address] had changed [Member name and email address] from [email address] to [email address] in group [their group name].

?

I¡¯m not a member of their group, don¡¯t have any management/moderator rights in their group and wasn¡¯t crazy about seeing my personal information in the hands of another group.

?

Perhaps the member of our group is also a member of theirs but is this expected behavior and if so how do I prevent my personal info from bleeding into the rest of the Groups.IO ecosphere?

?

Thanks,

gp
 

Can you clarify whether or not your own group is basic (free) or premium?

Frances?
--
Help available from Groups.io help and GMF wiki.

?
 

Our group is paid, premium.?
?
[ad removed by moderator]

From: [email protected] <[email protected]> on behalf of Frances <frances@...>
Sent: Tuesday, May 2, 2023 10:13:54 PM
To: [email protected] <[email protected]>
Subject: Re: [GMF] Member email address change on our group changed it on & notified another group
?
Can you clarify whether or not your own group is basic (free) or premium?

Frances?
--
Help available from Groups.io help and GMF wiki.

?
 

On Tue, May 2, 2023 at 09:12 PM, George Park wrote:
how do I prevent my personal info from bleeding into the rest of the Groups.IO ecosphere?
Don't change anyone's email address for them, make them do it themselves.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

So as a moderator for one group changing a members email address changes it for that group and also notifies every other groups.IO group they¡¯re a member of that the email address has been changed and who changed it?
?
Leaking PII/a moderators login info to people/groups they are unaffiliated with is not a great design.
?
[ad removed by moderator]

From: [email protected] <[email protected]> on behalf of Duane
Sent: Tuesday, May 2, 2023 11:22:27 PM
To: [email protected] <[email protected]>
Subject: Re: [GMF] Member email address change on our group changed it on & notified another group
?
On Tue, May 2, 2023 at 09:12 PM, George Park wrote:
how do I prevent my personal info from bleeding into the rest of the Groups.IO ecosphere?
Don't change anyone's email address for them, make them do it themselves.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

On Wed, May 3, 2023 at 03:12 AM, George Park wrote:
5 hours later I received an email from a moderator of a totally unrelated group forwarding a message that [My name & email address] had changed [Member name and email address] from [email address] to [email address] in group [their group name].
If you change a member's email address you are changing their account name so owners/mods of all other groups that account is subscribed to may receive a notification too.? As Duane said, if you get your members to do it themselves, you can avoid confusion.? The key thing to remember is that an account (email address) is the top level entity in Groups.io, not your group.

Regards
Andy
 

On Wed, May 3, 2023 at 04:21 AM, George Park wrote:
Leaking PII/a moderators login info to people/groups they are unaffiliated with is not a great design.
I don't consider an email address to be PII, though some do.? If it actually has your name in it, then it's by your choice.? As far as the login aspect, it's useless unless they also have your password.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

¿ªÔÆÌåÓý

We manage the group for the users, only those on a specific list are in the group at all and depending on other attributes are added to other sub groups.

Regardless of a user account in a system hierarchy tenant information should never be exposed to other tenants of unrelated groups.?

It¡¯s not sound security or information management practice and in this case exposes admin level credentials to an unknown number of people outside of an organization.?

There is zero rationale for someone other than the email user changing their email address to have their information propagated to others and would be simple to fix - just mask the email address change behind the user, strip it from outgoing messages, etc.

Get

From: [email protected] <[email protected]> on behalf of Andy Wedge <andy_wedge@...>
Sent: Wednesday, May 3, 2023 5:28:36 AM
To: [email protected] <[email protected]>
Subject: Re: [GMF] Member email address change on our group changed it on & notified another group
?
On Wed, May 3, 2023 at 03:12 AM, George Park wrote:
5 hours later I received an email from a moderator of a totally unrelated group forwarding a message that [My name & email address] had changed [Member name and email address] from [email address] to [email address] in group [their group name].
If you change a member's email address you are changing their account name so owners/mods of all other groups that account is subscribed to may receive a notification too.? As Duane said, if you get your members to do it themselves, you can avoid confusion.? The key thing to remember is that an account (email address) is the top level entity in Groups.io, not your group.

Regards
Andy

 

¿ªÔÆÌåÓý

Duane,?

It wasn¡¯t ¡°my choice¡± to have my email address blasted out to other group moderators - that¡¯s a groups.IO design decision and a ¡°feature¡± I was unaware of.?

The moderators of any group I¡¯m not a member of should not be able to even know I exist.?

A username and unlimited time and access is how hacking is enabled.?

Now I know I have to have any of our moderators understand how groups.IO handles their email address should they need to modify the email address of any of our members and/or create an email address with limited use and consider using MFA.

I¡¯ll let the moderator of the group that contacted me know all of this is by design.

Get

From: [email protected] <[email protected]> on behalf of Duane <txpigeon@...>
Sent: Wednesday, May 3, 2023 7:33:51 AM
To: [email protected] <[email protected]>
Subject: Re: [GMF] Member email address change on our group changed it on & notified another group
?
On Wed, May 3, 2023 at 04:21 AM, George Park wrote:
Leaking PII/a moderators login info to people/groups they are unaffiliated with is not a great design.
I don't consider an email address to be PII, though some do.? If it actually has your name in it, then it's by your choice.? As far as the login aspect, it's useless unless they also have your password.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.

 

On Wed, May 3, 2023 at 07:54 AM, George Park wrote:
It wasn¡¯t ¡°my choice¡± to have my email address blasted out to other group moderators - that¡¯s a groups.IO design decision and a ¡°feature¡± I was unaware of.
No, but it was your choice to use a variation of your name as your email address.

I didn't realize it until this discussion, but the Owners Manual doesn't include the fact that this information is included in the log/notification of other groups, so I'll suggest it be added.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

¿ªÔÆÌåÓý

Duane,

?

It¡¯s a shame how cavalier folks are with other people¡¯s data regarding this topic.

?

I choose to use an identifiable email address that my group knows me by.

One of the reasons for this is that many of our members were concerned about signing up with Groups.IO in the first place.

?

We selected Groups.IO as most of our members don¡¯t want to sign up for a service, managing external users via Office365 groups is burdensome and Groups.IO has some features that are greatly beneficial to our sub-group moderators who before Groups.IO had no way to manage email lists.

?

We have a defined curated list ¨C you are either on it, or you are not.

If you are not on it you¡¯re not added to the group at any level.

?

What I didn¡¯t choose, or know, that my email ¨C used only for this Group in all of Groups.IO ¨C would be programmatically shared without my knowledge or permission to people outside of my group. It¡¯s not a matter of only lack of documentation but of what the Groups.IO designers consider to be an acceptable practice. It¡¯s not.

?

I was under the mistaken understanding, as this ¡°feature¡± is documented nowhere, that my email ¨C used in only a single specific group ¨C would be shared by the system to other group moderators with no notification, logging or opt out capability. I stand corrected, or at least a better informed consumer.

?

In this age of hacking, ransomware, ID theft, etc. many services are making it more difficult for external actors to gain access to and securing their users data.

If Groups.IO elects to go in another direction at least I¡¯m aware of that now.

?

No more comment is needed regarding this topic.

We¡¯ll agree to disagree about what I find acceptable use of my email address.

?

?

From: [email protected] <[email protected]> On Behalf Of Duane
Sent: Wednesday, May 3, 2023 10:18 AM
To: [email protected]
Subject: Re: [GMF] Member email address change on our group changed it on & notified another group

?

On Wed, May 3, 2023 at 07:54 AM, George Park wrote:

It wasn¡¯t ¡°my choice¡± to have my email address blasted out to other group moderators - that¡¯s a groups.IO design decision and a ¡°feature¡± I was unaware of.

No, but it was your choice to use a variation of your name as your email address.

I didn't realize it until this discussion, but the Owners Manual doesn't include the fact that this information is included in the log/notification of other groups, so I'll suggest it be added.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

On Wed, May 3, 2023 at 10:46 AM, George Park wrote:
It¡¯s a shame how cavalier folks are with other people¡¯s data regarding this topic.
Actually, I'm on your side on this one, but I'm aware of the situation from reading the beta group, so know what to expect and use an address just for groups.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

On Wed, May 3, 2023 at 10:18 AM, Duane wrote:
I didn't realize it until this discussion, but the Owners Manual doesn't include the fact that this information is included in the log/notification of other groups, so I'll suggest it be added.
Interesting that in the Members' Manual it says this about changing your email address:

Note:?
?
This change applies to all groups you are subscribed to at the original email address.
If the new email address is already registered with Groups.io, a page appears that explains the account merge process and prompts you to verify that you want to merge your Groups.io accounts.

/helpcenter/membersmanual/1/understanding-groups-io-accounts/setting-account-preferences-and-viewing-account-information?single=true

This could be used as a model for the Owners' Manual.

Frances
?
--
Help available from Groups.io help and GMF wiki.

?
 

I suggest the Notice that is sent to other Groups say:
[x Group's Admin] has changed [Member name and email address] from [email address] to [email address]
or
[another Group's Admin] has changed [Member name and email address] from [email address] to [email address]
instead of
[My name & email address] had changed [Member name and email address] from [email address] to [email address] in group [their group name].


If the "Member name" is not the name connected to the email address (with their Email Provider),
rather than their Display name (which can differ from Group to Group),
then [Member name and email address]
should just be:
[email address]

-Michael
 

IIRC, the activity log entry?associated with changing account information used to have some generic wording about the group admin doing it, without any other identifier. Someone subsequently complained about this in beta because she couldn't tell which of her co-moderators had done it.

To make this person happy, the log entry was changed. I can only guess that the notification sent to those who select to receive it was changed at the same time.

Throughout, little though was given to the fact that this same notification is sent to admins of other groups. At least not by me.

In all such cases, if the Display Name or User Name is not populated, the email address will be provided instead, as that's the only identifier available.?

Note that if you do not proactively ask to receive notification of Account Changes, they won't land in your inbox anyway. Are we kinda over-reacting? I suspect so.

Anyway, that's the history as I understand it. I could be mistaken on a fine point or two.

Regards,
Bruce

Check out the groups.io Help Center?and?groups.io Owners Manual
 

On Wed, May 3, 2023 at 12:42 PM, Frances wrote:
Note:?
?
This change applies to all groups you are subscribed to at the original email address.
If the new email address is already registered with Groups.io, a page appears that explains the account merge process and prompts you to verify that you want to merge your Groups.io accounts.

/helpcenter/membersmanual/1/understanding-groups-io-accounts/setting-account-preferences-and-viewing-account-information?single=true

This could be used as a model for the Owners' Manual.
I remember seeing this in the manual. What I understood--and still understand--from this note in the Member's Manual is that the change ONLY "applies to all groups [one is] subscribed to at the original email address." It doesn't say that your email address or any information about you is going to be sent to owners/moderators from other groups you are not affiliated with. In fact, the only change of email addresses I've received in the few years I've been a group owner is from my own group members. I already have their names and email addresses and they know that.

Am I to understand that George's information about a change of email address has been shared with the moderators of groups he is not affiliated with? If that's really the case, I agree that there is something wrong here. The note that is in the Members Manual says the opposite. It would not help to also include this note in the Owners Manual.

Duane, I'm not sure the onus should be on users to create stealth email addresses for every group/services to which they belong. The onus is on the service providers to clearly explain what users sign up for and how their information is being used and shared, IMHO.?
--
____________
Jeannette B.
 

On Wed, May 3, 2023 at 04:32 PM, Jeannette Bellerose wrote:
Am I to understand that George's information about a change of email address has been shared with the moderators of groups he is not affiliated with?
George is the owner of a paid group.? He changed someone's email address for them.? An entry was made in the Activity Log of the other groups that person was a member of that showed George's information as the person that made the change.? Bruce's earlier message mentioned this.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
 

As a final followup, I found the discussing the procedure involved.? That topic is now moderated, but you can join beta and submit additional thoughts if you want.

Duane
--
Lots of detailed information can be found in the Owners Manual and Members Manual.
dave w
 

Gentlepersons involved,

It is sad that an event created by a person (a moderator or owner), using an unusual and unintended way, modifying with authorisation or not (the account email) of a 'member' has created their own issue with which they disagree vehemently.

I see no reason for BUA using these groups to be 'manage their account for them' as that is in itself a form of privacy breach [ie you don't own the people/ members, not their personal information] - yet have total control over that entity. Exceptional circumstances, yes a backdoor required, but not otherwise.

Creating a solution may be easy- however creating the problem was even easier- an unintended use of private accounts.
Should the feature be anonymised as requested/ demanded, then other problems will likely occur.

It is perfectly appropriate for 'traceable' assets to be shown when such changes are made.
Would you accept this as 'the norm' for any society, business or other venture, beyond 'admins' with license to modify?

Respectfully,
davew
 

Please see this from Duane:

As a final followup, I found the discussing the procedure involved. ?That topic is now moderated, but you can join beta and submit additional thoughts if you want.

Frances
?
--
Help available from Groups.io help and GMF wiki.

?

1 - 20 of 22