Security for underage users

I’m excited about your take on forums structure and organization of online communities.

I’m considering using it in the near future for an educational community for children, where children aged 6-17 would be the main users, perhaps a few thousand of them.
Naturally I worry about their online safety, and how Discourse could be used to an advantage over existing forums.
For simplicity considering an all-private discourse forum, what security features are there to keep dangerous people away? Such as requiring an approval or invitation from X number of people before signing in, or the absence of private messages all-around.

I know about the 4 levels of trust already, but this is not enough to protect children, I think.

Thanks

1 个赞

Firstly, IANAL. This is solely based on what I’ve heard and what I could find in the last n minutes.

If you’re doing anything with children under the age of 13, you need to read up on and comply with COPPA.

http://www.coppa.org/

From reading this page, here are some first steps: http://www.coppa.org/comply.htm

  • Make a custom Privacy Policy page at /admin/site_contents/privacy_policy
  • Place it somewhere prominent with /admin/site_contents/top and CSS
  • You also need to obtain ‘parental consent’. Consider making that part of your membership approval process.
  • Consider forgoing advertising and GA, as that will make compliance easier

I would also consult with a lawyer, as this stuff may be hard to get right.


This is not feasible, the flagging dialogue automatically creates PMs.

2 个赞

We did add a “agreed to the terms and conditions” checkbox to new signups for a customer. You would definitely want that here – @neil how can they turn it on?

http://forum.example.com/admin/site_settings/category/legal

4 个赞

What @riking said. tos_accept_required is one thing you’ll want to turn on.

Having some parents as moderators, or at least trusted members of the forum, could help too (unless it would stifle conversation to know that parents are reading everything). Education about flagging and how to spot suspicious activity can go a long way.

2 个赞

Are there any updates on this issue?
Any new features?

Is it possible to block all private messaging among a certain class of users?

This would be really good.
Just messages to and from Admins and Mods.
One less thing to worry about if your forum’s a little wild and free to sign up.

I’m also very uncomfortable about the messages being read by admins. The topic was closed I wish it could be reopened.
A Boolean to salt and obfuscate?

1 个赞

As I understand it, mods, and definitely administrators have the means to view private messages between other users. Coupled with some sort of homegrown reporting tool using the API, it should at least be easy to monitor for suspicious activity, particularly if PMs are expected to be a rarity.

Making it clear that you are doing this, or have the ability to do this may very well be enough to make troublemakers reconsider.

Mods can view flagged PMs only. Admins can view all PMs.

2 个赞

I’m not seeing this in my setup. I’m on version 2.7.0.beta5. How do I enable this?

Hi,

This isn’t a setting anymore AFAIK

You can create a user field for this by going to admin > Customise > User Fields

Result:

There is also a notice at the bottom reminding users about ToS and privacy etc.

3 个赞

Noted with many thanks.

您好,您找到这个问题的答案了吗?我们正在考虑禁用18岁以下用户之间的私信,但允许18岁以上用户之间进行私信。

2 个赞

目前,除非有人纠正我,否则例如将 U18 设置为 TL1。将其设置为 TL1 不能发送消息,而 TL2(18 岁以上)可以发送消息。但是,人们可能会撒谎。在我的示例中,有什么能阻止某人仅仅勾选一个框?

我喜欢在单个用户级别上允许/禁止私信的想法。

多亏了 @martin 前段时间,我们引入了“允许私人消息的群组”和“允许直接消息的群组”。这应该能满足您的需求!您可以创建一个“18岁以上”群组并在此处使用。

4 个赞

阻止他们像你进行的任何级别的检查那样,仅仅说“是的,我18岁”的,是同样的东西。

你实际上无法证明某人是孩子,除非付出非凡的努力,并且需要对每个人都这样做。即使那样也很容易绕过,除非你使用如此侵入性的程度,以至于没有人会为你的网络论坛费心去做。

你唯一的真正选择是:要么对整个社区进行极其侵入性的检查(例如,我们随机检查所有私人消息,并阻止任何提及外部通信的内容),要么相信人们不会撒谎,并以理想的方式遵守你的环境。