Privacy concern - maybe a limited notification option?
piotrek PublicSeen by 73Hey there.
I have a feeling that while notifications work great in Loomio, the danger of data leak is extremely high, especially when people are not using secure e-mails (all the content is explicitly written in the notification e-mail). It would be great to have an option to switch off content exposure within notifications and use them just to inform about new threads, events or so. Would it be hard to implement? What do you think?
Ok, to clarify - corporate e-mails (including google or hotmail or yahoo) are well known for analysing the data people receive for advertising purposes, but they also cooperate with law enforcement agencies. It would be nice if loomio wasnt making it easier to infiltrate and read group correspondency. That's it.
I'd be open to this as an option on a private instance, but email is the primary way that people use Loomio, and it's the primary tool that facilitators have to reach the people they're trying to facilitate. Here's a chart from a recent survey of our users, about what other tools they use in their group:
So, very nearly 100% of our users use email in some capacity alongside Loomio. Data privacy is a big concern here, but I think we're probably shooting ourselves in the foot if we spend time developing features which actively discourage use of the tool.
this is why i'm proposing it only as an option - nothing more, nothing limiting current functionality.
@reip I think your idea is great. And I also see it as something that would be a great job as an entry-level task. You're mostly going through email bodies and going if user.limited_email_info in our mailer templates.
Are you able to setup a development environment?
documentation here, old but hopefully relevant video here
We have most of our emails available in http://localhost:3000/dev/ (ie: your dev environment test urls) and those which are not there, I'd be happy to make available.
@robertguthrie Well, I think I missed "feature request" tag on the thread. I am not a developer, I don't really understand what you wrote here. I don't really have time now to dig deeper in this, but if there is anything a programming noob can do to help with it, I'm open to collaborate.
Hi reip. Just out of curiosity, I'm wondering what threat model you are concerned about?
It seems to me that if an attacker has access to someone's email account, they could just as easily perform a password reset on the target account and log into loomio to view all the details, even if the email notifications were uninformative. But I guess I'm not understanding your use case.