# Email security/obscurity for moderators is inconsistent
**URL:** https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837
**Category:** Bug
**Created:** [September 28, 2015, 2:29pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837 "2015-09-28T14:29:36Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 28, 2015, 2:29pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/1 "2015-09-28T14:29:36Z")
The user list hides emails (except for self, obscured), has a button to show them, and pressing that logs a “viewed email” event for each user on the page (I think - I didn’t actually try this on my instance).
However the Emails/All tab shows them all straight up in clear text (obscured in the screenshot), even for emails that _weren’t_ sent.
It seems these two pages ought to use similar enforcement mechanisms or the security is for nought?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 29, 2015, 1:16am UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/2 "2015-09-29T01:16:40Z")
Hmm maybe moderators should not have access to this tab @eviltrout?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [September 29, 2015, 1:44am UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/3 "2015-09-29T01:44:31Z")
Or require a click to view, just like all the other pages.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 10:30am UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/4 "2015-09-29T10:30:39Z")
Are we talking about the email tab in admin view? If so, I think I agree, I can’t think of a single time I visited that page out of necessity (in fact, I just visited it today for the first time based on what I can recall… I’ve yet to find a reason to visit that page out of today’s curiosity)
---
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 29, 2015, 10:52am UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/5 "2015-09-29T10:52:44Z")
Relatedly, this part of the “admin” page for a specific user:
I think it would fit better with the rest if Email and Logins were visible to moderators here.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 11:32am UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/6 "2015-09-29T11:32:18Z")
That I disagree with entirely! We use that a LOT to find connections between spammers and advertisers who are abusing our forum.
---
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 29, 2015, 1:30pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/7 "2015-09-29T13:30:02Z")
Sorry, what do you disagree with? Currently those two buttons don’t exist for moderators. I’m suggesting that maybe they should, since moderators can see emails in other places anyway.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 1:34pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/8 "2015-09-29T13:34:01Z")
Yes, as a moderator, we have used access to the email of a user in the Admin area, their Profile page, etc as a way to identify members as spammers, advertisers, etc.
We use it a lot, as it is one of the important keys, along with username patterns that we can use to immediately identify a user as part of a larger group who does nothing more than post frivolous crap. You’d be amazed at how terrible human spammers/advertisers are at trying to conceal themselves.
> [@calmh](#):
>
> Sorry, what do you disagree with? Currently those two buttons don’t exist for moderators. I’m suggesting that maybe they should, since moderators can see emails in other places anyway.
But they do exist for Moderators…
---
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 29, 2015, 1:34pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/9 "2015-09-29T13:34:35Z")
They don’t on my install. As admin, yes. As moderator, no. 🙂
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 1:35pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/10 "2015-09-29T13:35:40Z")
Hmm… that’s odd. brb, going to setup my local environment to run a few tests.
---
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 29, 2015, 1:36pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/11 "2015-09-29T13:36:44Z")
As TL3 + moderator I should say. Perhaps something is different as TL4, that I haven’t tested.
* * *
No, that doesn’t seem to make a difference.
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 1:45pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/12 "2015-09-29T13:45:11Z")
Ah, you need to enable `show email on profile (for staff only)`
If that is not enabled, you can’t see it on the Admin or User Profile page as a Moderator, once it is enabled, you can.
Phew, for a second I thought maybe this regressed 😄 (and I’m sorry about mis-understanding your prior reply)
---
### Author:  [@calmh](https://meta.discourse.org/u/calmh)
#### Post date: [September 29, 2015, 1:47pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/13 "2015-09-29T13:47:58Z")
Ehm, okay, that sort of makes sense. It makes the other places that still show emails make even less sense though 🙂
* * *
Right, so with that on (it was off by default), moderators do get the same set of “show” buttons on the profile. But perhaps that setting should then affect the user list page as well (if we don’t want moderators to be able to see emails, the button shouldn’t be there either right?) and indeed the email log page…
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [September 29, 2015, 1:52pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/14 "2015-09-29T13:52:48Z")
> [@calmh](#):
>
> Right, so with that on (it was off by default), moderators do get the same set of “show” buttons on the profile. But perhaps that setting should then affect the user list page as well (if we don’t want moderators to be able to see emails, the button shouldn’t be there either right?) and indeed the email log page…
Sounds logical. 👍
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [September 29, 2015, 4:38pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/15 "2015-09-29T16:38:33Z")
I think it makes a lot of sense to not expose that section to moderators. Here’s a patch with it:
[https://github.com/discourse/discourse/commit/3aaa9a87223243f28b59007feaf19cdaeb7b5373](https://github.com/discourse/discourse/commit/3aaa9a87223243f28b59007feaf19cdaeb7b5373)
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 29, 2015, 10:06pm UTC](https://meta.discourse.org/t/email-security-obscurity-for-moderators-is-inconsistent/33837/16 "2015-09-29T22:06:28Z")