Badge privacy and security options


(Thomas Davis) #1

For forums used in gaming, the member list is a vulnerability and the members of a group is even a bigger problem. Both of those already have the option to disable. But badges are wide open and present a problem for gaming communities. There is option to disable badges, but the feature is great for social community building and important.

I request the following improvements to badges.

  1. Add option per badge to disable the badge user lists that shows all the user with a badge.
    – a cool improvement to this would be able to select groups that can view it.
  2. Add option per badge to only display the badge on the user’s profile when that user, a moderator or an admin is viewing it.

(Régis Hanol) #2

I’m curious what kind of problem do badges cause? Why is it specify to “gaming communities”?


(Thomas Davis) #3

The problem is that there is a page that anyone can see which users have a specific badge.

In gaming communities user lists are used with malicious intent. Moreover some badges reveal who the key member’s are. If badges are used as a reward for good service, that will be publicly exposed as well. Badges themselves are open ended and powerful for rewarding people.


(Jeff Atwood) #4

Why not just disable badges then? Not following.


(Thomas Davis) #5

Because they are awesome when building a community. It is a great way for people to get rewarded for the achievements on and off the forum. I am asking for this option because the badges are a great feature.


(Sam Saffron) #6

We already have the “Show badge on the public badges page” option, why not hide it?

Can you give me a specific example of a badge that you wish was private and only visible to a user?


(Thomas Davis) #7

I saw this, but it always grey out and checked. That would be great if that hides the page from all users guest and logged in, since forum users is not the same as guild members.

Examples:

This are member lists and are not welcome.

  1. Basic badge on Discourse Meta
  2. Regular badge on Discourse Meta
  3. First Like badge on Discourse Meta

(Sam Saffron) #8

Honestly with so much disabled I would recommend you simply disable badges, they were not designed to be a “private” thing.


(Mittineague) #9

So it isn’t so much privacy and security (as in, let’s gang up and take down this top dog) but doing away with the default Badges?


(Thomas Davis) #10

Not doing away with the badges, doing away with the lists.


(Mittineague) #11

All Badge lists?

I don’t know how, but it seems over-riding the routing to some other page might work.

Though I guess removing all links to the lists would be better, if doable.


(Thomas Davis) #12

Yeah, that is why I am requesting the feature. Badges add so much personality to Discourse and I believe they are very important. I just need to block those list pages.


(Sam Saffron) #13

Yeah but why keep them on the user page? not following, people can still synthesise a list by visiting a bunch of profiles.


(Thomas Davis) #14

Good point, but it is the exact same logical reason we can hide member list now. If members do not post on public areas then they can only be found in the lists.


(Sam Saffron) #15

not really, you can still find them via search and directory (which you could disable)


(Thomas Davis) #16

Thanks for that. More things I need to lock down. :smile:


(Thomas Davis) #17

I have turned off badges for the time being. It is kind of depressing, so I hope someone will enable a way to turn of the member list feature of it.


(Rob Bowman) #18

Hello,

If I might add some light here. In certain gaming communities keeping your roster a secret is very important. This is both to hide you own size and strength as well as protect double agents. Hiding the users page is a great help in protecting the guild. That all make sense so far?

The badges are awesome for adding achievements as well as personal character to members. the issue now though is with the links to all members with that badge enabled we have just gone back to revealing our member lsists and thus our guild security will be compromised.

So my point is I appreciate I can hide the user page now, but please allow us the ability to hide our users thru other pages on the site such as the badges.

Thank you for the consideration.


(Erlend Sogge Heggen) #19

The use case is clear enough, but it’s very edge case. Your best bet is finding a 3rd party developer to make a dedicated plugin for these unique use cases.