Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I've built a simple web app Flask.io that enables users to create and share to-do lists.

It doesn't require sign up. This is an important differentiator. I don't want to force the user to register for a tool they haven't used yet.

How it works is when they create a list, a random slug is generated and they are redirected to that unique url e.g. flask.io/random-slug

My question is what security implications are there?

Removing sign up should improve the on-boarding UX, but is it worth it in exchange for a not as secure system, and should I introduce registration further down the flow?

The random slug is 5 characters long. Would love to know your feedback especially if any experience here.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

I do agree with the security concerns being posted here, but there still may be a market for such an app. I think a good use case for an app like this is for a shared task list - there are a lot of ways to build a shared to-do list, but all of them require at least a registration if not a download of some type, and it's a pain.

So, I'd say if you're going to keep it registration-free, then it would be pretty critical to provide some kind of warning to the user that their list is essentially public; maybe some kind of "I agree" consent form. You could even brand it as public, and offer registration as an additional, "private" tier of lists.

As long as users are aware of the risk that having a public to-do list entails, I'm sure there are plenty of people that would be okay with sharing their list with the world. Now getting users to read and understand your warning and NOT put sensitive information out there...that's certainly a challenge.

share|improve this answer
    
Seems like the best short term solution. –  Lee Mar 21 '13 at 19:42
    
You say that you don't agree with the security concerns. Could you please explain why you don't agree. –  JohnGB Mar 21 '13 at 20:00
    
No, I said I don't disagree with the security concerns. I edited my answer to remove the pesky and unnecessary double negative. –  Mark D Mar 21 '13 at 20:04

I have a lot of experience with task management. Tasks are extremely personal, and need to be treated as such.

A task list can consist of sensitive information, either explicitly or implicitly. For example "call bank re: loan refusal" is more than I want anyone to find out, and "call Dr Smith" could reveal that I'm seeing a medical specialist when I don't want that to be known. This isn't even beginning to skim the surface, this is only assuming a single line. If there's additional task information (say, a URL or notes), then the risk for revealing sensitive information is that much higher.

A five-character string is trivial to hack via brute-force, thus inadvertently revealing that sensitive information.

share|improve this answer
    
Great feedback. Do you feel the option to password protect the url/list would be adequate or more along the lines of a user account (username, email, password)? –  Lee Mar 21 '13 at 1:15

It's a security and privacy risk if you allow anyone to see a todo list without being sure that you are showing it to the right person.

While it is a good idea to let a new potential customer use your software without first signing up, it is not a good idea to let them access it later on with nothing more than a short slug

There are two ways that I would consider handling it.

  1. Use a cookie and place a long code in the cookie to identify the person.
  2. Offer a demo without signing up. When they are creating their list in the demo, make it clear to them that to protect their privacy, if they want to save their list to use later, they will need to sign up for an account. Make sure that if they sign up though, that the list they have created in the demo is now in their account.

I would go for option 2, as the first option is likely to cause more support issues, and many people have cookies turned off.

share|improve this answer
    
I like this option. Will implement it at some point in the future. –  Lee Mar 21 '13 at 19:42

Agree completely with nadyne. It's not so much brute forcing the 5-char ID (which implies that you don't know what the ID is and you're trying to find it).

It's more along the lines that a determined attacker with scripting skills and a small botnet can enumerate your entire task-space, and collect every single active list, and can continually re-visit areas to see what changes.

I would suggest some additional method to identify the original user. e.g. Allow the list to be created, and then require an email address after say, 3 items. So that on a re-visit, the user has to enter their email address to see the list.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.