1

Here I ask just about a university's internal password protected discussion boards. They are for university students and instructors.

Because you must log in with your university details and password, can't "anonymous" posts be traced and deanonymized, if the university legally needed or wanted? Wouldn't PhD's in computer science know how to unmask the identities of these anonymous posters, if a university legally authorized them?

Improve this question
3
  • 9
    That would depend on the design of the specific software platform being used, wouldn’t it? I don’t know how you can expect a completely general answer. But broadly speaking, it’s certainly the case that when a student is logged in to their account, they may have doubts about whether their posting is truly anonymous, which may not be easy to assuage. (For example, if the platform was Facebook, I wouldn’t trust the anonymity even if I wasn’t logged in.)
    – Dan Romik
    Nov 19, 2021 at 1:51
  • 2
    If you really want to know, a good way to find out is posting a link to a Pornhub video on the forum and see what happens.
    – Federico Poloni
    Nov 19, 2021 at 9:38
  • 5
    Btw, computer science in theory for PhD is not the same as information security in practice.
    – qwr
    Nov 19, 2021 at 10:00

1 Answer 1

Reset to default
9

It is extremely unlikely that university forums are completely anonymous. Universities are legal institutions, and must comply with national laws. In many countries, institutions are required to store user data for a few years in case the police or government needs the data for criminal investigations. There are actually very few email, VPN, etc. companies that can truly claim to provide full anonymity, and in order to achieve that, they must not just encrypt user data end to end, but their servers must actually be set up to not store any user data in the first place.

Therefore, you should always assume that everything you write in such a forum is liable to be stored somewhere, along with your user info.

Improve this answer
1
  • 1
    There's probably a degree of separation - at the simplest one database saying that the user logged in on a particular IP address at a particular time, another saying that an IP address posted a comment to the forum (the log may really be of Single Sign On tokens). Then they'd have to want to combine the two, and they probably retain the right to do so in cases of undefined "abuse". But by default the instructor running the board shouldn't have access to the names associated with comments.
    – Chris H
    Nov 19, 2021 at 10:22