Trello Board User's Security Risk

TarotRedhand

I use variations of my user name all over the web. Also, I tend to have a somewhat healthy paranoia when it comes to my computer security. I think I have discovered a security hole when it comes to voting on the Trello boards as they are currently set up. You have to give a real name when you register with Trello in order to be able to vote. When you click to vote, the box that comes up displays not just the user names of those who have already voted but also the real names that they have entered. Should I choose to vote my real name will be exposed for all to see as well. This is a recipe for disaster, at least for those who vote on there. Should criminals or other ne'er do wells look in on there they will find that a good part of their work has been done for them. I know that some people have used nicknames for this but I am surely not the only one who entered their real name in all innocence while not expecting to have this personal information leaked.

Is there no switch on there to hide peoples real names? If there is please flip it at your first opportunity. If not then can you remove the display of who has voted? Should the worst come to pass and a way has not been found to hide this information I can foresee the more litigious suing BD which is something none of us would want to see.

TR

JuliusBorisov

Thanks for your concern. As soon as the office opens today, this will be looked at.

TarotRedhand

Thank you. I actually only noticed this last night even though I had previously voted on there.

TR

JuliusBorisov

Added

https://trello.com/c/mccaZ0kE/156-privacy-disclaimer (Input)
https://trello.com/c/xs4mnHx8/80-privacy-disclaimer (Roadmap)

TarotRedhand

I apologize but from now on you'll have to address me as Fred Blogs. Well at least as far as Trello is concerned. Obviously not my real, Real Name. It's what the press use in the UK when they are talking about everyman. I looked at my profile and saw an edit button. Nah, it couldn't could it... He, He it worked.

TR

FreshLemonBun

If you have stalker problems keeping usernames/identities and accounts separate and unlinked is usually the best option.

Proleric

For that matter, the bug reporting site only shows the real name of the author. I'm not personally bothered, but it will deter some people. Also, we know one another by nicknames, so if I see a bug that's worth discussing, I have no idea who to PM.

Sherincall

Proleric said:

For that matter, the bug reporting site only shows the real name of the author. I'm not personally bothered, but it will deter some people. Also, we know one another by nicknames, so if I see a bug that's worth discussing, I have no idea who to PM.

We were encouraged to put our names as Firstname "Nickname" Lastname exactly for that reason. Random example: https://support.baldursgate.com/issues/32975

I'm sure if people don't want to put their real names, "Nickname" "Nickname" would work just as well.

JuliusBorisov

Proleric said:

For that matter, the bug reporting site only shows the real name of the author. I'm not personally bothered, but it will deter some people. Also, we know one another by nicknames, so if I see a bug that's worth discussing, I have no idea who to PM.

https://support.baldursgate.com/ has the following line: "(Please note that the first name and last name fields will be visible to other users. Feel free to use a pseudonym if you'd prefer to keep this information private.)"

Trinital

Tarot you are so cute. Do you always give your full name when asked? LoL.