Please change the policy on trusted list requests

Question

I lead the Unknowns team. I ask for TL add when I don't get a response to a message to update the profile as part of a three-step process to get the profile orphaned if necessary. Please fix IMMEDIATELY the system which adds that PM to my own personal TL when they accept my request...I'm not making friends and meeting cousins during this process; I'm sourcing and clearing up Unknowns..and I won't be continuing until I am assured that this has been stopped. I"m not the first to make this request....Thank you.

Comments

Ditto to this request from Pam. I will never do another TL request after having one of those requests result in finding that PM on the trusted list for my personal profile, and that he had added 3,000 of his profiles to my Watchlist, which took the better part of two days to find and remove them all.  Some protections need to be put in place for this process.

---

Something along the lines Pam and Patricia request may be under consideration. See my improvement request and Jamie Nelson's response at this link.

---

I don't think your proposal addresses the fact the system automatically adds someone to your TL when they add you to theirs.

---

You're right sorry, Emma. But I think what you, Pam and Patricia have noted is a bug. Hopefully it would be cured as a result of a rewrite of the code, though it would preferably be fixed sooner than that.

Answer 1

We decided that we are no longer going to add someone to your Trusted List when you invite them to WikiTree or request to be on their Trusted List.

We also fixed the bug with the bulk Trusted List tool.

Comments

Hooray!!! And thank you for your work!!!

---

Thank you, thank you!

---

Thank you, Jamie. This is a great outcome.

Answer 2

I have sent many Trusted List requests over the years, and people have *never* been added to my personal Trusted List.  Or do you mean Watchlist? (not that a living person would be added to my Watchlist either; only the profile I have asked about).

Comments

The person can get added to the TL of the personal profile of the person making the TL request. I happened to me also.

---

Me too:  https://www.wikitree.com/g2g/611937/everyone-that-invited-take-their-profile-personal-trusted

---

I've had it happen three different times. And often it can take considerable effort to remove the added and unwanted profiles from my Watchlist.

---

So, it's not so much a simple 'Trusted List request'.  It's when you invite someone to join WT.  That's why it's never happened to me - because I haven't invited anybody.

---

NO, I simply made a TL request for a profile to change the LNAB while working with the Unknowns project. Had done it several times, same process no problem, but there is something that the person receiving the request can do that will let them send you as many profiles as they wish, thousands of them, if they have that many on their watchlist, and can somehow get themselves added to the TL of your personal profile.  Been years since I have responded to a TL request as the recipient so don't know what the options are on the receiving end, but there is something that needs changing to prevent this from happening.

---

This happens to me every time I make a trusted list request and am accepted. I have to check my own TL to remove them right away.

---

I wonder if there may be three different things happening here:

1. the invitation problem
2. use of the bulk Trusted List addition tool by somebody who knows your email address
3. a bug that adds person A to the Trusted List of member B's own profile as well as to the Trusted List of another profile C when A approves a Trusted List request by B for access to C (which is managed by A).

The original post above by Pam seems to be referring to case 3, with Pam in the role of member B.

---

It does seem to be multiple problems with TL. My experience was the same as Pam's where I sent a request to be added to TL of a profile to do a quick edit and then remove myself, but it turned into a nightmare of finding i had over 3,000 of that PM's profiles on my watchlist as well as him on my person profile..  In this post, Pam did not mention receiving gift of being added to TL of many profiles she did not ask for, but think I recall her posting about that also happening to her a ways back.

---

#3 isn't a bug, Jim. It was set up this way intentionally. I have mentioned it twice before in g2g over the past several years.

---

Can you please give links, Emma? It can't be intentional. Why would it be? Nobody wants their own profile to be editable by a random member. And even if they did, they could grant Trusted List Access directly, instead of it happening as an unexpected side effect of something else.

Jamie has implied that the invitation behaviour (number 1) is intentional, but that's different—though I don't think it's a good idea either.

---

I found one 2017 post by Emma, but it's about issue number 1 not number 3.

---

Unfortunately, I've created so many posts over the years I can't find my old posts.

---

Sorry Emma, but with this absence of evidence I will continue to think that issue 3 is a bug. It would be extraordinary if something so risky had been done on purpose.

---

I think I've now found one of the posts Emma may have been referring to:

https://www.wikitree.com/g2g/999869/how-people-getting-profile-trusted-list-without-permission

But that is not about situation 3 either. In situation 3, there are three different profiles A, B and C. In the situation described in that post of Emma's, there are only two profiles: Emma's own, and the profile of the other member.

Answer 3

Thank you for bringing this up again Pam. I have posted in g2g previously at least twice on this topic. I build trees for a lot of people I don't know and being on their TL makes it easier to add them as PM of the new profiles. I don't want strangers being added to my TL.

Answer 4

I'm not able to recreate this happening.

Is the manager of the profile you are requesting TL access for added to your profile's TL every time you request? Or is it happening only sometimes?

Are the profiles you are requesting TL access for Open, Private, Unlisted?

Comments

Jamie - thanks for checking. I only work on Open and Private profiles (because I'm trying to clear Unknowns)....don't know when it happens and when it doesn't, but when a friend told me to check it, I found about 20 people on my personal TL...if/when it happens again, I will look very carefully at who it is and what the situation was....

---

Inviting someone to WikiTree will add them to your TL if they accept the invitation, but if you didn't recognize any of the people as people you invited, then there probably is some bug somewhere in the TL request process.

Figuring out what exactly is causing it may be tricky, so definitely let me know if you notice it happening again so I can try to narrow down where the bug is.

---

Those weren't people I had invited.....and I won't be doing any TL requests for a week or two (in the middle of something on my own tree....) but then I will check daily so I can track it..thanks for your attention to this!!

---

Jamie, this happens to me every time I ask to be on someone's personal trusted list--not trusted list of a profile they manage. They are already members of WikiTree.

---

Emma, please forgive my ignorance here, but what is the purpose or advantage of being on the Trusted List of another member's own profile?

---

When I am on someone's trusted list, their name shows up in a box at the bottom for me of any privacy tab. When I am creating an entire tree for someone (and I do this a lot), all I have to do is click their name and click add, and voila, they are on the TL. Then I click add as manager. So much faster than having to copy/paste or type their email a zillion times.

---

Ok, thanks for explaining: that does sound useful.

---

Jim - here's another scenario to answer your question. I work on Unknowns. If I find a source, or the LNAB, I place a comment on the profile. If they fix it, great, we're done. But many of these PM's are either inactive or just don't respond. In that case, I wait a few days, ask for TL status and send a PM...If there is still no response after 7 days, I can ask that the profile be orphaned so that I can update it. This is WT policy, and you will see it detailed on our Unknowns process page.

---

Thanks for this information, Pam. But are you asking to be on the Trusted List of the member's own profile (like Emma is), or on the Trusted List of the Unknown profile? If the latter, that is not what Emma is describing, but what I called case 3. You are B; the Unknown profile is C; and the manager of the Unknown profile is A. If I'm understanding correctly, the bug in this case is that when you ask for Trusted List access to C, and A agrees, then as well as you getting access to C, A gets access to your own profile. Is that a correct description?

---

pamela anderson smith	8:41 AM (0 minutes ago)
to WikiTree

Jim - I'm not sure exactly when it happens...often the PM is inactive when I make these requests....but I will watch in future to see what happens and report back to Jamie. Maybe it only happens when they are active?? Deleted the previous ones, so don't know....

---

Thanks Pam. At least one would think it shouldn't happen if they never accept the request; but maybe that's not the only factor.

---

I just had this happen to me. I requested TL access to half a dozen profiles and they added me to their entire trusted list. Lo and behold, he and 3 of his family appeared on my own TL, and it's not the first time it's happened. https://www.wikitree.com/g2g/1645871/bulk-trusted-list-bug

---

Thanks to Gill the bug has been tracked down -- we will work on a fix, and I'm starting a discussion with the Team about the other times we automatically add people to your TL and if it's still a good idea.