# Is it a security violation to show a directory of users?
**URL:** https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557
**Category:** Feature
**Created:** [March 20, 2015, 12:34am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557 "2015-03-20T00:34:36Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@jmay](https://meta.discourse.org/u/jmay)
#### Post date: [March 19, 2015, 10:24pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/1 "2015-03-19T22:24:01Z")
Beautiful. But as @watchmanmonitor said there should be an admin option to restrict visibility of the user directory.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 19, 2015, 10:28pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/2 "2015-03-19T22:28:30Z")
I don’t really understand the reasoning behind “this should be hideable”.
You can get the same info by visiting user pages, so you’d need to hide all user pages, too.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [March 19, 2015, 10:45pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/3 "2015-03-19T22:45:09Z")
People aren’t really going to take the time to visit every single page, and if someone just wants to be a lurker, they’d never be discovered by their posts (but would ostensibly be visible at the bottom of the list).
From a privacy and data harvesting point of view, I know that another group I’m setting up on discourse would not be OK with someone being able to view the entire directory.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 19, 2015, 10:50pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/4 "2015-03-19T22:50:29Z")
> [@User directory feedback](https://meta.discourse.org/t/user-directory-feedback/26550/6):
>
> I know that another group I’m setting up on discourse would not be OK with someone being able to view the entire directory.
Still, that’s security-by-illusion. If someone wanted to bad enough, they could hit the API to pull the users.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [March 20, 2015, 12:11am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/5 "2015-03-20T00:11:22Z")
> [@User directory feedback](https://meta.discourse.org/t/user-directory-feedback/26550/8):
>
> hey could hit the API to pull the users.
Where are these users getting an API key?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 20, 2015, 12:12am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/6 "2015-03-20T00:12:41Z")
Just add .json to any URL and see what happens! No need for authentication (api key) for this use of the API. This user data is 100% public, if someone wants it, they can get it. Regardless of whether the `/users` page is visible or not.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [March 20, 2015, 12:15am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/7 "2015-03-20T00:15:18Z")
We’re going down a rabbit hole here. Presenting this data in such a useful, beautiful, inviting way\* is far different than someone discovering the API and making thousands of while guesses as to the names of all users.
\*this really is a great feature.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 20, 2015, 12:25am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/8 "2015-03-20T00:25:55Z")
No no, using the anonymous API they can _enumerate_ all the users. Perhaps I wasn’t clear. No guessing is involved at all.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 20, 2015, 12:27am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/9 "2015-03-20T00:27:35Z")
> [@User directory feedback](https://meta.discourse.org/t/user-directory-feedback/26550/17):
>
> using the anonymous API they can enumerate all the users.
Regular humans won’t bother doing this.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [March 20, 2015, 12:27am UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/10 "2015-03-20T00:27:39Z")
oy vey. I’ll burn that bridge later.. I’m really not worried about API use.
---
### Author:  [@Sander78](https://meta.discourse.org/u/Sander78)
#### Post date: [March 20, 2015, 12:36pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/11 "2015-03-20T12:36:13Z")
A simple use case then:
A company has clients and for every group a special category that only the members of that group can see. No need to see who else is a client of that company.
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 20, 2015, 2:54pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/12 "2015-03-20T14:54:10Z")
Frankly, if you’re worried about security or confidentiality, you **must** worry about a motivated attacker. As long as the API allows anonymous enumeration of users and anonymous access to user profiles, hiding stuff from the GUI is just pointless; in fact, I think it’s better to put it out there so that all users realize what kind of information about them is publicly visible.
However, this does in no way mean that this level of security is pointless _in general_. If you’re building a site with strong confidentiality requirements, then those are the requirements you need. No ifs or buts, noone’s arguing against your needs, it’s your decision. But right now, Discourse simply doesn’t provide this feature yet and security is too important for a bandaid solution.
…
All that said… having a site setting to disable the directory is still a good idea, even if only because some people may consider it clutter and want to remove that entry from the menu. Also, one could argue that the directory might cause previously peaceful users to look for shortcuts to compete for the top spots, thus lowering overall content quality.
---
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [March 20, 2015, 4:04pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/13 "2015-03-20T16:04:20Z")
> [@elberet](#):
>
> Frankly, if you’re worried about security or confidentiality, you must worry about a motivated attacker.
I’m more concerned with idle gossip and petty frustrations between users. This /users thing is really nice, but just a source of distraction in an otherwise dedicated group. I just don’t want to have to deal with this, if it can be avoided.
Of course, from a forum admin point of view, and to see my standing on meta, it’s very interesting data that I’m glad was surfaced.
EDIT Added my hypocrisy 😉
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 20, 2015, 4:10pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/14 "2015-03-20T16:10:01Z")
> [@watchmanmonitor](#):
>
> I’m more concerns with idle gossip and petty frustrations between users.
It’s pretty much the same rationale for making the badge system optional. Admins should able to opt-in to “competetive” natured components.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 20, 2015, 8:05pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/15 "2015-03-20T20:05:51Z")
> [@watchmanmonitor](#):
>
> I’m more concerned with idle gossip and petty frustrations between users. This /users thing is really nice, but just a source of distraction in an otherwise dedicated group. I just don’t want to have to deal with this, if it can be avoided.
Yes, but you are basing this on.. what data?
Who is to say there _will_ be a problem? How would they know this page even exists? It’s not exactly listed in the topnav..
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 20, 2015, 8:33pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/16 "2015-03-20T20:33:52Z")
> [@codinghorror](#):
>
> It’s not exactly listed in the topnav..
Yes it is, under “Users”. 🙂
---
### Author:  [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 20, 2015, 8:35pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/17 "2015-03-20T20:35:35Z")
That’s the hamburger menu… 😃
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 20, 2015, 8:43pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/18 "2015-03-20T20:43:31Z")
I would rather institute this option based on _evidence of an actual problem_ instead of “we are guessing what will happen”.
I don’t like options explosions, we have enough as it is.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [March 20, 2015, 8:52pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/19 "2015-03-20T20:52:04Z")
I think this whole topic is foolish.
> Does it violate a user of a public forum to display their public activity in a public list?
I think not, especially considering that all the same information is already displayed [elsewhere](https://meta.discourse.org/users/codinghorror/activity/likes-received)(1) [within](https://meta.discourse.org/users/codinghorror/activity/likes-given)(2) [the](https://meta.discourse.org/users/codinghorror/activity/topics)(3) [site](https://meta.discourse.org/users/codinghorror/activity/replies)(4) [without](https://meta.discourse.org/groups/trust_level_0/members)(5) [use](https://meta.discourse.org/groups/trust_level_1/members)(6) [of](https://meta.discourse.org/groups/trust_level_2/members)(7) [any](https://meta.discourse.org/groups/trust_level_3/members)(8) [public](https://meta.discourse.org/groups/trust_level_4/members)(9) API.
(with one exception “Topics Entered”).
Yes, it’s not collated in one place - but it’s still there.
> [@elberet](#):
>
> some people may consider it clutter and want to remove that entry from the menu
These “people” can always use CSS to hide the menu option, even if there isn’t an admin option to hide it.
```CSS
#site-map-dropdown a[href="/users"] {
display: none;
}
```
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [March 20, 2015, 8:57pm UTC](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/20 "2015-03-20T20:57:52Z")
Don’t forget:
- Load the latest topics list until you’ve seen last month
- Open all the topics and record the list of users
- Profit??? Probably not…
[Next page](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557.md?page=2)