Changes to how we handle access to private forums that are restricted by email domain

Today we’ve rolled out a change to how we handle users accessing private forums that are restricted by email domain in order to address a potential security issue. This won’t affect any other type of private forum.

We try to make it as easy as possible for your customers to interact on your UserVoice forums, because we know they don’t want to go through a big account setup just to give you ideas. Part of accomplishing this is allowing customers to interact on forums without setting a password, which has been very successful.

Download

The gap we discovered is that potentially (we have no indication that this has happened) a user could be given access to a private forum, never set a password, and then have someone else use their email address to access that private forum and the ideas within. This would, of course, require the malicious person to know the exact email of someone invited to a forum. It’s an edge case that, to our knowledge, has never been exploited, but absolutely something that needed to be taken care of.

In order to plug this potential gap, we’re now requiring users set a password in order to access any private forum restricted by email domains. This will affect new and existing users.

Now, when an existing user without a password visits a forum that they have been given access to, instead of gaining access to the forum they will be given a link to create a password. This will generate an email with a confirmation link (to verify their identity) that will give them the ability to password-protect their profile. Once their password is set they will be able to access the private forum as before.

If you have any questions or think your customers are experiencing any issues, don’t hesitate to contact us.

Thanks for your understanding – we know this may cause some inconvenience for your customers, but in the end it will provide greater security for your company.

-Evan Hamilton
Community Manager, UserVoice

Get our best stuff delivered directly to your inbox.

No thanks

Want to build swoon-worthy products?

At UserVoice, we help you turn customer feedback into a better product. We aggregate incoming product ideas and measure the business value of each idea so you can prioritize what to build next. Uncover your next big feature today!

Start Free Trial