cryptee / web-client

Cryptee's web client source code for all platforms.
https://crypt.ee
Other
445 stars 22 forks source link

[Change] Make links to other Cryptee files look the same as clickable URLs rather than a whole rectangular card. #178

Closed bruisedsamurai closed 1 year ago

bruisedsamurai commented 1 year ago

I believe it will be more ergonomic if the links to other notes are something like this or like they are Obsidian.MD rather than being a rectangular Div.

johnozbay commented 1 year ago

Hi there 👋🏻

This is by design, and it's this way to prevent users from accidentally clicking on insecure links.

Current design differentiates between external links and internal links/attachments.

External links

— could theoretically come from documents you've imported (i.e. a markdown file, evernote note, or a cryptee doc someone sent you which you've imported)

— could have malicious js in the url

— could lead you to phishing sites

— could track you

— could be insecure (to make this harder, we actually make http urls yellow, and https urls green.

Internal Links

— cannot come from documents you've imported, and can only link to your own documents

— cannot have malicious contents (since it's content you've created)

— cannot lead to phishing attacks (since it's content you've created)

— does not track you

— and is opened in a secure sandbox (i.e. PDFs are opened inside Cryptee's own PDF viewer in a sandboxed iframe to prevent attacks)


Due to these differences, we don't intend on making internal and external links look the same. We may change the boxy design some day, or add more features to it, or simplify it further, but we for sure won't make them look the same as regular URLs as this is not only bad UX but would lead to confusion as well as the potential security issues I mentioned above.

The reason markdown-based editors like Obsidian etc use the same design is due to the limitations of markdown format itself as a data storage medium, and I think they might be merely working around the problem instead of addressing it altogether.

Hoping this makes sense ✌🏻

Best,

J