Timeline for Token-based group invitation link
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 9, 2019 at 16:13 | comment | added | ThoriumBR |
You could have a max-uses counter server-side for each token, incremented every time someone uses the token. This way if people send the token to a high traffic site full of mischievous users, they won't add thousands of users on the channel.
|
|
| May 9, 2019 at 16:12 | comment | added | Steve | Not familiar with how Slack builds their links. Logs and history are difficult because there's a good chance they're already in a position of power, but at the same time they might not be because someone made a copy and shoved them onto a share somewhere. | |
| May 9, 2019 at 15:38 | comment | added | Markus | These are valid points. The forwarding is intentional, everyone in the group is equal and may invite others at their discretion. Regarding logs etc., does this differ from time-limited invite links from e.g. Slack? I’m figuring that if a user’s email or history is compromised, there’s little I can do anyway. Thoughts? | |
| May 9, 2019 at 15:13 | comment | added | Steve | The security of this resting only on the fact that it's impossible to guess in a limited period of time. There are some interesting side effects here. First, anyone with it can forward it. Second, these will show up in history, mail, and server logs, so anyone with that access can grab them and use them. | |
| May 9, 2019 at 10:31 | history | answered | Markus | CC BY-SA 4.0 |