Call to Action
I second this feature request. --> I hope other readers will do so, too.
Risk
IMHO link sharing (in its current basic form) is one of the top security risks of CryptPad. An evil user or an user mistake (accidential sharing) is one of the top probabilities of the possible threats. So the sophisticated cryptography and zero knowledge architecture won't protect this simple threat.
Addtionally it's hard to detect. I don't know of any logging / monitoring, so you can't know if a link is used, how often and from whom. It might be that admins (self host) can mitigate this with the CryptPad log level. But common users are helpless. Also such monitoring could be against the zero knowledge approach (e.g. IP logging).
(A simple monitoring help would be a counter in the GUI, how often a link (URL) was accessed.)
Solutions
AFAIK the CryptPad team plans an "unsharing" feature by generating a new shared secret and a new link and so excluding the unwanted users. This is what one would manually do by deleting the shared document, creating a new one and sharing it again. But it also seemed to be rather complex technically and AFAIK it's not planned yet, so this solution won't come anytime soon (AKA within the next 6-9 months).
So the low hanging fruit would be to make it possible to disable sharing at all as proposed by @q9f and tried by @iser .
This would mean:
- make it a configurable option (because most users want sharing)
- only useful to admins (self host) since any better solution would need significantly more time and I doubt the CryptPad team would invest this time, instead of working on the "unsharing" feature
Alternative
Since IMHO this concers primarily self host instances as justified another low hanging fruit would be hitns how to hack the code to disable sharing like @iser started.
Disclaimer:
Of course this is an open source project, so these are suggestions, not demands and my thanks go to the CryptPad team for the great work of the last years.
