Password protected public link shares : time to improve password protection UI to avoid a trap that many users fall into
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
For a long time now, the password protection UI has been the cause of failure for many users, whether "gifted" or not.
Whether the password is optional (activated manually by clicking on the checkbox), proposed by default or even imposed, one step is often overlooked: recovering the password before it is hashed and irrecoverable.
I see two improvements:
- Add a sentence "For security reasons, this password will only be shown once" (unlike screenshots, remember to include the comma). I didn't invent this sentence. It's already used elsewhere, to generate application passwords. In my opinion, this phase should perhaps be bolded, or preceded by a small warning icon.
- I find the password recovery process rather tedious. First of all, whether the password is proposed by default or not, or even imposed, there is no copy button/icon, which forces the user to select the password, then do a CTRL+C or right-click "copy". It's even worse when the password is neither proposed by default nor imposed, as it appears hidden and you have to click on the eye to copy it. A copy button must therefore be added.
But this isn't perfect, because in the case of a password-protected public link offered by default or forced, there are 2 pieces of information to copy and paste (in one or even two separate e-mails, for example): the URL and the password. So perhaps, when the password is proposed by default or forced, you shouldn't put a copy button as I've just suggested, but copy automatically to the clipboard after creating the share. Example: "Share URL: {share url} - Share password: {share password}". In the case of shares where the password is completely optional (not proposed by default, and certainly not imposed), we would still have the copy button in the field, after manual activation of password protection.
How to use GitHub
- Please use the 👍 reaction to show that you are interested into the same feature.
- Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
- Subscribe to receive notifications on status change and new comments.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by reviewing the current password-protected public-link sharing UI and the existing application-password wording, then confirm which proposed behavior is wanted. Done means an agreed warning and a clear copy or clipboard flow for the URL and password.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, php
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100