Hello,

I have set up a survey with anonymized responses with token-based response persistence and Save referrer URL ("Responses will have their referring URL logged. Cannot be changed")

I have sent it to a small number of people to test their reactions and asked them to comment on the survey.

When I look through the responses
(https://{surveydomain}/index.php?r=admin/responses/sa/browse/surveyid/{surveyID})
the token is listed under refurl.

So, I can rebuild a list of who-answered-which-question-how very easily.

Perhaps the referrer url should not be saved(savable) for anonymised responses.

Any suggestions?

-Graham-
LimeSurvey version 3.15.3+181108
(I noticed that 3.15.8 (190130) is available after I started the survey and didn't want to update until the survey was complete).

advanz_lu wrote: Perhaps the referrer url should not be saved(savable) for anonymised responses.

+1 !!!!!

Looks like Denis sees this as a feature request.

I'm against automatic restriction of saving referrer when activating anonymous mode.
In different environments other data (IP-adress, browser agent etc. ) could be used to identify people too.

But LimeSurvey should allow you to enable or disable the capturing of these data even during a survey. That is the case in many survey tools. You can even pause a survey without going through a deactivation/activation.

If you cannot deactivate the survey, you cannot change it. So just ignore the referrer, if you are the only one with access to the raw data.

jelo wrote: I'm against automatic restriction of saving referrer when activating anonymous mode.
In different environments other data (IP-adress, browser agent etc. ) could be used to identify people too.

I really think if you say to user's it's anonymous : you MUST make it as anonymous as possible.

If i remind IP adress are not resgitered with anonymous survey (it was the case before).

If you want referrer url : don't say it's anonymous .

DenisChenu wrote: If you want referrer url : don't say it's anonymous .

I don't need the referrer, but I'm aware of the history of LimeSurvey. The "smart" ideas to protect the user are often having sideeffects. Like filtering EndURL (which then broke URL more often) and the XSS setting, which is deactivated on every installation to get workarounds running.

It the same with the automatic privacy notice. The "smart" tool approach is causing more work in the end. www.limesurvey.org/forum/can-i-do-this-w...cy-every-time#168441

From my perspective as a user/survey creator I (just) want to know what the rules are.

If I want an anonymised survey either:
A. LimeSurvey sets the parameters so that it IS
or
B. Tells me what I have to set (and not set) so that it is.

At the moment, I have to know it (like having special "insider" knowledge).
If there are more than one survey admin and they are not really interested in the inner workings of LimeSurvey the chances are that I will be telling recipients it's anonymised and it isn't. And one of those admins could take advantage of the data.

Also,
- if LS is being used by universities this could cost someone their degree/doctorate - if it was made known that the survey that they said was anonymised was in fact not anonymised.

This could be bad news for the LS project. (do I have to mention Oxford Analytica ????)

The attached shows the options when activating a survey.
I suggest either :
A. SET "Save IP address" and "Save referrer URL" to NO when "Anonymised responses" is set to Yes
or
B. pop-up a message to say "WARNING: Your survey will only really be anonymised if you set "Save IP address" and "Save referrer URL" to NO" when "Anonymised responses" is set to Yes

- And of course option B advertises how to cheat the respondents!
My suggestion is option A.

-Graham-

PS:

"jelo wrote: I'm against automatic restriction of saving referrer when activating anonymous mode.
In different environments other data (IP-adress, browser agent etc. ) could be used to identify people too. "

I don't think this is reasonable logic.
Just because it "might" be possible to join responses to respondants doesn't mean that LS should make it easy.
(particularly when the respondent is being told the responses are anonymised.

If there is a way outside LS to join the responses to respondants (ie information in the host log files that LS has no control over) then I don't see how the lawyers could make a case.
- but I'm not a lawyer!

-Graham-

In my example it's "just" a question of the referrer url so where's the problem of forcing this to "NO" when anonymised is "Yes" ?

-Graham-

Personnaly i think you are right : we must not allow saving referrer url when a sentence like this is shown «The record of your survey responses does not contain any identifying information about you, unless a specific survey question explicitly asked for it. »

It's totally false

I really think it's a major issue

I agree as well. The "anonymous" mode in LS should be as anonymous as possible within the software.

You can still create other "anonymous" surveys by internal processes. But the mode provided by Limesurvey needs to be as anonymous as possible and the case described above, bug or feature, is definitely a breach when it comes to anonymity.

One update:

I notice that in the survey responses (https://{survey_domain}/index.php?r=admin/responses/sa/browse/surveyid/{surveyID}) there is the startdate and datestamp.

Does this:


Contradict this:

( www.limesurvey.org/manual/Participant_settings )



Thanks,

-Graham-

This should be definitely NOT be the case for anonymous surveys.

Please make a bug report, if you are on the latest release.