We are currently using Cryptpad intensively with a team and and have done so for the past 2-3 years. There are a couple of issues with sharing I would like to raise and propose some changes.
The main problem is the ability to generate shareable links the contain the key to access a file or directory. Once generated, you don't know where this link will end up and you completely give up the control of the data, even if you trust the people you share the data with.
On top of that, it's a recursive problem, because everyone who has your share link, can generate new share links from within your directory for any file. There is currently, to my knowledge no way to disable and prevent this.
However, we recently found out about the beauty of teams and access lists. They are exactly what teams need to more strictly control access to files and drives. W.r.t. teams I also have some UX feedback, but I will create a separate post on that. (Edit: Display team drives as directory in user drive)
Here are two ideas how to improve this situation drastically.
- Allow owners/admins to disable sharing for a file or directory (and all containing files). Access can still be managed through teams, contacts, and lists.
- (Preferred) Make "sharing" and "access" two mutually exclusive features that cannot be used at the same time, meaning if you create an access list, disable the sharing option for the file or directory (and all containing files).
Also, it's really crucial that parent access rights are strictly inherited by child items.
Please let me know what you think.
Thanks for considering it.
