Security for underage users

[josiastobias]

I’m excited about your take on forums structure and organization of online communities.

I’m considering using it in the near future for an educational community for children, where children aged 6-17 would be the main users, perhaps a few thousand of them.
Naturally I worry about their online safety, and how Discourse could be used to an advantage over existing forums.
For simplicity considering an all-private discourse forum, what security features are there to keep dangerous people away? Such as requiring an approval or invitation from X number of people before signing in, or the absence of private messages all-around.

I know about the 4 levels of trust already, but this is not enough to protect children, I think.

Thanks

[riking (Kane York)]

Firstly, IANAL. This is solely based on what I’ve heard and what I could find in the last n minutes.

If you’re doing anything with children under the age of 13, you need to read up on and comply with COPPA.

http://www.coppa.org/

Children's Online Privacy Protection Act

From reading this page, here are some first steps: http://www.coppa.org/comply.htm

• Make a custom Privacy Policy page at /admin/site_contents/privacy_policy
• Place it somewhere prominent with /admin/site_contents/top and CSS
• You also need to obtain ‘parental consent’. Consider making that part of your membership approval process.
• Consider forgoing advertising and GA, as that will make compliance easier

I would also consult with a lawyer, as this stuff may be hard to get right.

---

@josiastobias

the absence of private messages all-around.

This is not feasible, the flagging dialogue automatically creates PMs.

[codinghorror (Jeff Atwood)]

We did add a “agreed to the terms and conditions” checkbox to new signups for a customer. You would definitely want that here – @neil how can they turn it on?

[riking (Kane York)]

@codinghorror

@neil how can they turn it on?

http://forum.example.com/admin/site_settings/category/legal

[neil (Neil Lalonde)]

What @riking said. tos_accept_required is one thing you’ll want to turn on.

Having some parents as moderators, or at least trusted members of the forum, could help too (unless it would stifle conversation to know that parents are reading everything). Education about flagging and how to spot suspicious activity can go a long way.

[quixoth22]

Are there any updates on this issue?
Any new features?

Is it possible to block all private messaging among a certain class of users?

[geoff777]

This would be really good.
Just messages to and from Admins and Mods.
One less thing to worry about if your forum’s a little wild and free to sign up.

I’m also very uncomfortable about the messages being read by admins. The topic was closed I wish it could be reopened.
A Boolean to salt and obfuscate?

[sdaugherty (Stephanie Daugherty)]

As I understand it, mods, and definitely administrators have the means to view private messages between other users. Coupled with some sort of homegrown reporting tool using the API, it should at least be easy to monitor for suspicious activity, particularly if PMs are expected to be a rarity.

Making it clear that you are doing this, or have the ability to do this may very well be enough to make troublemakers reconsider.

[codinghorror (Jeff Atwood)]

Mods can view flagged PMs only. Admins can view all PMs.

[b4oshany (Oshane Bailey)]

@neil

tos_accept_required

I’m not seeing this in my setup. I’m on version 2.7.0.beta5. How do I enable this?

[ondrej]

Hi,

This isn’t a setting anymore AFAIK

You can create a user field for this by going to admin > Customise > User Fields

Result:

There is also a notice at the bottom reminding users about ToS and privacy etc.

[b4oshany (Oshane Bailey)]

@neil

tos_accept_required

Noted with many thanks.

[Lize_Gibson (Lize Maeve)]

Hallo, haben Sie eine Antwort darauf gefunden? Wir möchten private Nachrichten zwischen unseren unter 18-Jährigen deaktivieren, aber unseren über 18-Jährigen weiterhin private Nachrichten zu ermöglichen.

[ondrej]

Im Moment, es sei denn, jemand korrigiert mich, ist es zum Beispiel, U18 auf TL1 zu setzen. Setzen Sie es so, dass TL1 keine Nachrichten senden kann und TL2 (über 18) Nachrichten senden kann. Allerdings könnten die Leute lügen. In meinem Beispiel, was hindert jemanden daran, einfach eine Box anzukreuzen?

Ich mag die Idee, PMs auf individueller Benutzerebene zuzulassen / zu verbieten.

[nat (Natalie T)]

Dank @martin haben wir vor einiger Zeit „Gruppen mit persönlichen Nachrichten aktiviert“ und „Gruppen mit Direktnachrichten aktiviert“ eingeführt. Dies sollte Ihrem Zweck dienen! Sie können eine Gruppe „über 18“ erstellen und sie hier verwenden.

[Kartoon]

@ondrej

Menschen könnten jedoch lügen. In meinem Beispiel, was hindert jemanden daran, einfach ein Kästchen anzukreuzen?

Dasselbe, was sie davon abhält, bei jeder Überprüfung auf jeder Ebene, die Sie durchführen, einfach zu sagen: „Ja, ich bin 18“.

Es gibt buchstäblich nichts, was Sie tun können, um zu beweisen, dass jemand ein Kind ist, das keinen außergewöhnlichen Aufwand erfordern und für jede einzelne Person angewendet werden müsste. Selbst das ist einfach zu umgehen, es sei denn, Sie wenden ein solches Maß an Eindringlichkeit an, dass sich niemand die Mühe machen wird, es für Ihr Webforum zu tun.

Ihre einzigen wirklichen Optionen sind, unglaublich aufdringlich für die gesamte Community zu sein (z. B. wir überprüfen zufällig alle privaten Nachrichten und blockieren alle Verweise auf externe Kommunikation) oder darauf zu vertrauen, dass die Leute nicht lügen und Ihre Umgebungen idealerweise befolgen.