Add password protected Linksharing design - #28
Conversation
|
|
||
| - **CAPTCHA layer.** With the inclusion of per-accessKeyID and/IP rate limiting, we mitigate the risk factor of brute force | ||
| attacks, but do we also want to include captcha requirements on password submissions? | ||
| - **Paid-tier gating.** Do we want this feature to be available to paid-users and others with paid privileges? |
| - **CAPTCHA layer.** With the inclusion of per-accessKeyID and/IP rate limiting, we mitigate the risk factor of brute force | ||
| attacks, but do we also want to include captcha requirements on password submissions? | ||
| - **Paid-tier gating.** Do we want this feature to be available to paid-users and others with paid privileges? | ||
| - **Raw downloads.** Do we want password protected shares to be downloadable? |
There was a problem hiding this comment.
I should have been clearer here 😅
I mean after the user has unlocked by password for the first time.
There was a problem hiding this comment.
:) yes after password is entered then we can show the linksharing page as usual with download enabled.
| attacks, but do we also want to include captcha requirements on password submissions? | ||
| - **Paid-tier gating.** Do we want this feature to be available to paid-users and others with paid privileges? | ||
| - **Raw downloads.** Do we want password protected shares to be downloadable? | ||
| - **Previews.** Do we want to support social previews to work for these shares? |
There was a problem hiding this comment.
Same as the previous comment,
I mean after the user has unlocked by password for the first time.
This is more a technical decision whether we want to block previews and downloads entirely whether the user has unlocked the link share
| ### Open questions | ||
|
|
||
| - **CAPTCHA layer.** With the inclusion of per-accessKeyID and/IP rate limiting, we mitigate the risk factor of brute force | ||
| attacks, but do we also want to include captcha requirements on password submissions? |
There was a problem hiding this comment.
I assume the rate limiter would consider both the accessKeyID and IP address at the same time, because if we rate-limit only by accessKeyID, we might unintentionally block access for the n+1 user. Anyway, I don’t think we would even need this rate limiter if we implement captcha, right?
|
Thank you Wilfred, I added some comments on the open questions. |
4 participants
Issue: https://github.com/storj/storj-private/issues/1539