nextcloud / nextcloud/server

Add an optional password hint

Open
#64,204 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

[!TIP]

Help move this idea forward
  • Use the 👍 reaction to show support for this feature.
  • Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
  • Subscribe to receive notifications about status changes and new comments.

Is your feature request related to a problem? Please describe.

I frequently share photo's from events through Nextcloud. The share links will be shared with a larger group. I'd like to increase security by adding a password so that a copied link (say from browser cache) does not directly result in the photo's being visible. But people tend to forget passwords and aren't very good in managing or remembering passwords.

So I thought it would be nice to have a password hint, so that if I choose an obvious password, like the event name or the city where it was located, that people can enter it in without having to look up the password.

Describe the solution you'd like

An option to add a password hint in the share menu.

It will show up as a public text on the password prompt.

This is secure in the sense that the password prompt doesn't disclose other information about the content to guess the answer.

If a malicious actor would have access to an email with the information the malicious actor would already have the credentials to log in, so it won't affect that scenario.

For sure the option to add such public information should be controlled by the admin.

Describe alternatives you've considered

Permitting a public label would be a more generic method. Currently the label of the share can be set, but this is not intended for information to the user.

Such a generic piece of text could also be used to add a line like 'Contact person@domain.org if you no longer have the password'. This could be an alternative to the password prompt.

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the existing share menu and public-share password prompt, then trace how administrator controls are applied to shared links. Done means an optional hint can be configured for a share, shown publicly at the password prompt, and governed by an administrator setting without weakening password protection.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, php
Domain
authentication, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.