I need your thoughts on a privacy related matter. I find this fact being very provocative.

So, at work we use Gmail:
Person AB has email AB@company.tld
Person ABC has email ABC@company.tld

How is it that when you send an e-mail to AB, that ABC sends back a god damn Out-of-office, without ABC being in either To, CC or BCC?

I reckon that the mailbox AB is owned by said company, and ABC is the owner of all those accounts. But shouldn't the contents of such mailbox still be private in some regard? (At least until AB isn't in the company anymore?)

It's funny, as a customer said she got an out of office from ABC, while solely sending one to AB.. I noticed this a few weeks back, and I'm rather infuriated by the fact that there's a possibility that every e-mail AB reveives, also ends up in in ABC's box.

🤔

@Floydian nice, should've done that...

Automatic forwarding, some kind of other feature, could be anything really haha

Email aliases is also a possibility

Hahaha, if it's forwarding my e-mails he did receive like 50K of debug logs a few months ago (bad practice, but I forgot I left it there..) Now I know why he was complaining :') Karma.

Even then, he should be able to keep it from sending Out-of-office e-mails back to everyone x)

As mentioned before, could be anything.. I'm not using Gmail here but aliases on the server could very well be the reason. On my personal servers, I've set it as such that email sent to anywhere on the domain will be delivered to my internal account (because I'm its only user and it helps with assigning email addresses in sign-up forms on the fly).

Now if the email is sent to a generic company email, it's normal for the mailserver to distribute that to all the employees in that department, and some employees' client then goes like "oh hey, thanks for the email but I'm not in the office!". Though I'd personally prefer to keep that segregated into a common mailbox which everyone in the department can authenticate against.. eh, design choices.

If there's email sent from AB and ABC sends out a out-of-office reply.. assuming that both are placeholders for real names and are in the same domain, chances are that this is a misconfiguration. Do contact whoever is your company's postmaster about this.

FYI y'all, it's not that I didn't know those possibilities as I've set up mailservers before (probably not set up right, but they work.. :') )

I just don't like the fact, even that box isn't safe from prying eyes. Then again, it's understandable as it's a company's box and set-up, on Google's services for crying out loud.. x)

Well, any postmaster or anyone who can SSH into the mailserver (as root or elevate their permissions) can read out the entire /var/vmail, right? Not really a privacy issue I'd say, rather a configuration issue here. If that coworker ABC isn't supposed to see the email, the mailserver (I know that it's Dovecot in Linux servers but not sure about Gmail) should be configured to not send it out to their mailbox in the first place.

@Condor true.. file based pos. x)

No, ABC is elevated, as being the MFCEO

@xewl that explains it :P
CEO wanting to keep tabs on all the employees and their company email, now that's indeed a privacy issue, and a felony if it's not properly communicated to the employees by putting it in their contract. Other than that, I'd suggest not using the company email for personal stuff then. Also, you could consider filing an issue with law enforcement if email monitoring isn't mentioned in the contract.

@Condor not that I'm even considering using it for personal things.. (:

Oh well, I'll just live with it, but I'll mention the bad Out-of-office setting tho.

@Condor @linuxxx Apparently he knows, should be because of GVault (Back-up system)

@xewl Hmm, sounds legit.. but again I have no experience with Gmail on business level so..
¯\_(ツ)_/¯

Kinda strange how those "backups" end up in his live mailbox though. I'd assume that there'd be a dedicated backup area and even compression format (such as tar, git, system images or whatever) instead of just sending the emails as-is to the CEO's inbox. Sounds a little bit fishy and a weak excuse IMO :/

Not sure yet if they actually end up in his box though @Condor