Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking into setting up a forum for a writers group I attend; this would be for sharing stories amongst ourselves. In order to retain first rights, this has to be within a hidden forum, where the wider internet can't gain access to it.

Assuming that the server it's hosted on is trustworthy, are these forums actually secure for these purposes? I'm considering using Simple Machines forum software, but this is a more general question: how sure can I be that the information on these forums will remain hidden? There is obviously the risk that a member will spread stuff around (unlikely, as we all know each other in the real world), but can the software generally be considered secure?

Will any hidden forums be cached by, for example, Google? If not, why not - is it a genuinely secure feature of this kind of software, or the equivalent of asking nicely (like robots.txt)?

I should perhaps clarify that I am going to be the sole administrator of this website, and the host is someone I believe to be trustworthy, so problems with terms of service etc. are irrelevant to me. I am asking if the software can be considered secure.

share|improve this question

3 Answers 3

There's a simple-ish solution to your problem. First, acquire a dedicated server (or VPS) of your own or via a host. Put your software on it. Put the forum data in an encrypted volume loaded on bootup (helps later on). Use access control to ensure only the forum software can access that volume. Set up SSL or a VPN so that it's required to access the forum. Set up password-protected access to the site and give your friends the password. You can optionally, maybe via forum software, set up permissions of the various users.

Now, you have a system that only trusted people can connect to and that stores most confidential stuff in an encrypted volume that can be wiped simply by "loosing" the key. There's plenty of other considerations for making something approaching a secure forum. It's not easy. However, this basic setup will provide a baseline of protection.

share|improve this answer
    
Encrypting the data isn't useful in this scenario. It only protects against attackers who would steal the storage media, which isn't a threat here. I wouldn't do it, it needlessly increases the risk of losing all your data due to improper backup procedures. –  Gilles Jun 4 '13 at 10:13
    
It's of smaller use than the other suggestions. Many people don't like leaving all their private information on a server that might be used by another person. Anything stored on a regular filesystem is still there upon delete. This can be picked up by the next user, by a drive thief, etc. Encryption by default eliminates these and other worries. You're right that a person might screw up a backup. Yet, truecrypt is very reliable and using it means the entire forum (maybe software too) can be backed up by downloading one file: the volume. (Or a diff of it.) OP can leave crypto out if desired. –  Nick P Jun 4 '13 at 16:07

Well, the answer to your question is pretty clearly defined in the First Rights of Publication article you linked to:

What constitutes “being seen by the public” is the gray area of First Rights. But over the last couple of years, a consensus seems to have emerged.

Most publishers feel that if you “publish” or post your writing publicly on the Internet without any password protection, you have given up your First Rights.

Publishers do not consider something public if it has been posted in a password protected environment where readers must register and login before they can access the writing. In this case, most publishers feel that the work still retains its First Rights.

This seems pretty straightforward to me, and it makes it then less so of a question pertaining to technical aspects of how secure are private forums of this and that service provider, and more so author's intention not to reveal his/her works to the general public. This then makes it a legal issue at worst, where any potential such dispute would probably involve foremost determining one's intent, and less so (if at all) one's ability to judge security of third-party applications. Which, needless to say, might be quite unreasonable to expect anyway.

Make sure you make yourself fairly acquainted with service provider's Terms of Service (TOS), End User Agreement, and other relevant documentation that would describe authorship of published materials therein, though. The devil is in the details. Caveat emptor; many websites reserve the right to republish any materials posted therein by their users, or use it for website's promotion (Search Engine Optimisation or SEO is one of the tricky ones, but also RSS Atom feeds,...), and hide that fact somewhere within the self-harming dull legal yawn of a fine print.

Sometimes, best you could do is to put their claims to the test, by posting a new topic and a few replies to it, and then observing if this information contained within somehow leaks to search engines in the following weeks. Make sure you use fairly uncommon sentences and/or words that will simplify your search.

share|improve this answer

There are several risks here, in particular:

  • An authorized user may reproduce your post elsewhere.
  • The forum software may be flawed or misconfigured and allow anyone to log in.
  • The forum software may later be reconfigured to be public.

You can't do anything about someone reposting your content, but fortunately that doesn't matter for your purpose. If someone publishes something in violation of your copyright, that won't affect your first rights.

As long as the publisher considers posting on a private forum to not count as prior publication, it doesn't matter if the post turns out to be publicly accessible in some way that bypasses the intended security. That would be no different from someone sneaking into your home and stealing your manuscript. It would be an illegal act on the part of the person who bypassed the intended security, and therefore it wouldn't could in any legal argument.

The case of a forum whose configuration changes after you've posted is more problematic, because it doesn't involve anybody doing anything illegal, and yet it causes your post to become public. To figure out such a case, you would need to know the precise circumstances (did you have a contract of some kind with the forum host? Were you informed that the forum might later become public?) as well as the publisher's precise rules for first rights (if he has rules set in stone or at least on paper). This gets into the realm of lawyers.

It wouldn't hurt to accompany your post with a disclaimer like “This post is only for review amongst members of the Springfield writing circle. Public distribution is prohibited.”. You would need to ensure that the place where you're posting it is indeed intended to be private to that writing circle, but the additional language might tip the balance in the specific case of a changed configuration.

Do note that this is not legal advice, it's some stranger on the Internet providing an unsourced opinion, which is worth exactly the paper it's printed on.

share|improve this answer
1  
The point of first rights isn't so much a legal one, as the fact that a publisher won't want to use anything that's already been published, since a large part of any potential audience may have seen it already; I will be the sole administrator of this forum, and the host is someone I consider trustworthy, so the only issue is the software: will the contents of hidden forums be cached by the likes of Google? –  evilsoup Jun 4 '13 at 0:03
    
@evilsoup If the software is properly written and configured, then no, Google won't be able to read its contents and hence will not be able to cache it. I can't tell you whether the specific program you mention in your question is well-written or easy to use, that would require a security analysis which is far more than what you can expect from a Stack Exchange post (doing this in industry would typically run into ~10k$). –  Gilles Jun 4 '13 at 0:19
    
that's good enough for me, if you can expand that comment into an answer, perhaps with some information on what exactly 'properly written and configured' entails (so that I can put some questions to the forum software devs) then I would accept it. –  evilsoup Jun 4 '13 at 0:25
1  
@evilsoup - Since you later added that this will be a custom hosted solution, then why not simply password protect access to all of it? This would clearly disable any robots from indexing it, and should cover you well enough in case of a dispute. Your question pertaining to how secure the software is, is then irrelevant, and since you're after online collaboration with a group of known individuals, password protected access control and distribution of passwords shouldn't be a problem either. –  Noordung Jun 4 '13 at 1:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.