VIP ⭐️⭐️⭐️⭐️⭐️

Solved

Is it possible to make profile pages private in a public community?

9 replies
218 views
Translate All

We are currently a private community, but planning to transition to a public setting soon.

While we can use permissions to gate specific category forums and modules, there does not appear to be a way to do that for a few core aspects of the platform like Events and Profiles.

Is there a way to prevent profiles from being public (or at least from being indexed in search) on a public community?

The use case: Personal information on the profile page. Community members are comfortable having it be available to others in the community, but don’t necessarily want it (and all their associated posts) to come up in a google search of their name.

Blastoise186Answer

Helper ⭐️⭐️⭐️

As far as I can tell from the guides, I’m afraid this isn’t really possible with anything built-in, and I’d be hesitant to ask Greg to create a script to modify the page headers to do it either.

The only reliable fix would be to remove all personal information from profiles before going public - which I strongly recommend doing for privacy and user safety reasons. Otherwise, there’s a risk of much more than people just discovering your users names that is not particularly great.

Don’t forget that just blocking out search engines wouldn’t prevent a malicious user scraping the entire community and mining out all that personal information anyway. I already know of several ways it can be done but I won’t reveal any such details for security reasons.

Bug blasting absolutely everything... The Blastoise Way

Blastoise186Answer

Helper ⭐️⭐️⭐️

As far as I can tell from the guides, I’m afraid this isn’t really possible with anything built-in, and I’d be hesitant to ask Greg to create a script to modify the page headers to do it either.

The only reliable fix would be to remove all personal information from profiles before going public - which I strongly recommend doing for privacy and user safety reasons. Otherwise, there’s a risk of much more than people just discovering your users names that is not particularly great.

Don’t forget that just blocking out search engines wouldn’t prevent a malicious user scraping the entire community and mining out all that personal information anyway. I already know of several ways it can be done but I won’t reveal any such details for security reasons.

Translate

Bug blasting absolutely everything... The Blastoise Way

DannyPancratzAuthor

VIP ⭐️⭐️⭐️⭐️⭐️

I really appreciate the insight @Blastoise186.

@SmartlyGreg (or other CSS pros) would it be possible to hide all of the profile fields from visibility for unregistered users? Or would the user data still be exposed?

It sounds like there’s some risk of personal information being exposed, based on Blastoise’s comments.

Translate

FYI: I am no longer active in this community

Blastoise186

Helper ⭐️⭐️⭐️

No worries. Now I must put my security hat on for a minute.

I’m afraid even with Custom CSS, the user data would still be exposed. Let’s think for a moment that you know me as being an evil hacker who wants to steal all your user data (it helps to set the scene!) and you react by using Custom CSS to simply hide it. There’d be nothing stopping me from using Chrome DevTools to temporarily disable your Custom CSS and reveal the data again, use Inspect Element to see through the Custom CSS, simply using View Page Source to grab it from there or even use a text-only user agent that’s incapable of rendering fancy graphics. And tada! I’ve just run off with all that “hidden” user data. All you’d really do is probably slow me down by about 20 seconds at most.

Even with a custom script, there’s no guarantee of truly hiding the user data because I think you’d still be reliant on Custom CSS as well.

Translate

Bug blasting absolutely everything... The Blastoise Way

DannyPancratzAuthor

VIP ⭐️⭐️⭐️⭐️⭐️

Thanks, again. @Blastoise186. That exposed personal data is very concerning.

For fields that are set as private visibility in control, is that data protected? Or is that information exposed as well?

Translate

FYI: I am no longer active in this community

Blastoise186

Helper ⭐️⭐️⭐️

Nope, those are private to everyone except yourself and Mod+. No other users can see those fields and they’ll have (private) next to the tag in your settings.

I can also say this much. I’ve never managed to expose that field via any sneaky tactics either - the platform simply doesn’t serve those fields to you at all unless you have permission to view them.

Translate

Bug blasting absolutely everything... The Blastoise Way

SmartlyGreg

Helper ⭐️⭐️⭐️

@Blastoise186 I think you’ve explained this very clearly, there is not much we can do but artificially hide these but anyone could take a look at the content of the page at the touch of a few keys. Or at least nothing I know how to do!

Translate

DannyPancratzAuthor

VIP ⭐️⭐️⭐️⭐️⭐️

Idea added for anyone who wants to vote for it:

Translate

FYI: I am no longer active in this community

jvdc

Expert ⭐️

Hey all, I see this question is 3 years old and perhaps things have changed since?

Are there solutions for hiding user profiles from non-logged in users in a public community?

Translate

revathimenon

Gainsight Community Lead

Hey @jvdc

We currently don’t have the functionality on CC yet.

Maybe this could be possible via custom work - possibly some of our cc wizards in here has tried it before?

Translate

Where focus goes, energy flows.

Didn't find what you were looking for?

Sign up

Welcome to the Gainsight Community