Doodle3D / doodle3d-client

The Doodle3D web interface that people can access on computers or tablets to draw doodles and control the Doodle3D WiFi box.
www.doodle3d.com
GNU General Public License v2.0
3 stars 8 forks source link

Secure settings page? #219

Open peteruithoven opened 10 years ago

peteruithoven commented 10 years ago

When Doodle3D is for example used in school context teachers might want to "secure" the settings page.

I would personally like to avoid passwords, because that could add a lot of extra complexity, like password recovery systems and keeping track of whether people are logged in.

We could keep it very basic by always requesting the password when you want to open the settings (so we don't have to keep track of a login). And to get into the settings when you forget the password we could add the exception that we don't ask for the password when you're connected to the box by ethernet cable.

Can we come up with other solutions that add a basic level of security?

What if we add an option to hide the settings button and make the settings available under a specific url? like adding /settings behind the current url, so when you're box has http://192.168.5.1 as it's url, you can access the settings under http://192.168.5.1/settings. Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there.

rooiejoris commented 10 years ago

What if we add an option to hide the settings button and make the settings available under a specific url? Like adding /settings behind the current url, so when you're box has http://192.168.5.1 as it's url, you can access the settings under http://192.168.5.1/settings. Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there.

(like in the very very old days when there was a bug that the stop button wasn't visible but was working when you clicked that area...: )

i like this one..! or by a shortcut, then you cannot access it by a tablet, that might be a disadvantage

[just thinking...for the settings, you use the settings from the wifibox isn't it, can you use the default security setup of the box...?!]

cheers\joris

On Wed, Mar 5, 2014 at 5:49 PM, Peter Uithoven notifications@github.comwrote:

When Doodle3D is for example used in school context teachers might want to "secure" the settings page.

I would personally like to avoid passwords, because that could add a lot of extra complexity, like password recovery systems keeping track of whether people are logged in.

We could keep it very basic by always requesting the password when you want to open the settings (so we don't have to keep track of a login). And to get into the settings when you forget the password we could add the exception that we don't ask for the password when you're connected to the box by ethernet cable.

Can we come up with other solutions that add a basic level of security?

What if we add an option to hide the settings button and make the settings available under a specific url? like adding /settings behind the current url, so when you're box has http://192.168.5.1 http://192.168.5.1 as it's url, you can access the settings under http://192.168.5.1/settings http://192.168.5.1/settings. Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there.

Reply to this email directly or view it on GitHubhttps://github.com/Doodle3D/doodle3d-client/issues/219 .

rooiejoris commented 10 years ago

Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there. forgot to say: this is currently already doable by the user. change the image...

cheers\joris

On Wed, Mar 5, 2014 at 9:31 PM, Joris [van Tubergen] rooiejoris@gmail.comwrote:

What if we add an option to hide the settings button and make the settings available under a specific url? like adding /settings behind the current url, so when you're box has http://192.168.5.1 http://192.168.5.1 as it's url, you can access the settings under http://192.168.5.1/settings http://192.168.5.1/settings. Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there.

(like in the very very old days when there was a bug that the stop button wasn't visible but was working when you clicked that area...: )

i like this one..! or by a shortcut, then you cannot access it by a tablet, that might be a disadvantage

[just thinking...for the settings, you use the settings from the wifibox isn't it, can you use the default security setup of the box...?!]

cheers\joris

On Wed, Mar 5, 2014 at 5:49 PM, Peter Uithoven notifications@github.comwrote:

When Doodle3D is for example used in school context teachers might want to "secure" the settings page.

I would personally like to avoid passwords, because that could add a lot of extra complexity, like password recovery systems keeping track of whether people are logged in.

We could keep it very basic by always requesting the password when you want to open the settings (so we don't have to keep track of a login). And to get into the settings when you forget the password we could add the exception that we don't ask for the password when you're connected to the box by ethernet cable.

Can we come up with other solutions that add a basic level of security?

What if we add an option to hide the settings button and make the settings available under a specific url? like adding /settings behind the current url, so when you're box has http://192.168.5.1 http://192.168.5.1 as it's url, you can access the settings under http://192.168.5.1/settings http://192.168.5.1/settings. Maybe even hiding the button, but leaving that area (or another area) clickable so can still open the settings by clicking there.

Reply to this email directly or view it on GitHubhttps://github.com/Doodle3D/doodle3d-client/issues/219 .

peteruithoven commented 10 years ago

Titus Braber also suggested having a alternative url next to the existing url. But to access a admin version, where the settings button is always available. And maybe where the print button is always available, see: https://github.com/Doodle3D/doodle3d-client/issues/256 Using admin.doodle3d.com is impossible when the box is connected to a existing network, but it could be something like {regular adress}/admin or draw.doodle3d.com/admin.

peteruithoven commented 9 years ago

We're implementing a limited view, that's accessible by adding ?l=1 to the url, maybe we can also hide the settings button in that case. https://github.com/Doodle3D/doodle3d-client/issues/256