I see Infinity with a lot of potentials and with just a few little things updated it could be used to resolve many important jobs in my larger team.
One of the little things is the displayed filename in various views (Table, Columns etc).
From the screenshot of a Table view below, you see there are multiple files attached to an item.
How does an user determine which icon reflects which specific file?
With mouse over, the browser shows the direct URL (on AWS) to the file with a random filename. With the randomized filenames, the user still cannot determine which specific file it is.
In the itemâs detailed view, only the first 10 characters or so of the file name are displayed.
In the Columns view, the filename is simply missing, even when the atttribute is enabled.
Suggestion: Display the filenames with mouse over or replace the icons with the file names.
Also an extended question to (2) but not related to the filename display, is anyone with the link could open the file without having access to Infinity. So the files are not access controlled. Thatâs a huge security concern in a multi-team or multi-company collaboration environment. Until integrations to the various cloud drives are done, It probably should at least be masked and redirected only through Infinity.
But what are those files? How does an user tell which file to use?
In table view I can see the full name when I hover over the icon and wait for 2-3 seconds. So part of your suggestion is already implemented Though it doesn´t work in the item-detailed-view. I agree that should be more consistent. I would also suggest that the filename is shown quicker, so if you need to check out 5 pdfs you don´t have to spend 10-15 seconds on it. For images it´s easy to see, because you have the thumbnails.
I disagree with you on replacing the icons with the file names, because this would need too much space to display. It might be a good idea for the detailed for pdfs and other text documents to use a list of attachments. But it´s not a good idea for pictures.
As far as I can see, the files are not access controlled. I can open my files using the aws-link whether I´m logged in or not. And also they are not deleted on aws when I delete them on infinity, which is probably due to backup/restore reasons. But the access for everyone that knows the link has to be changed especially in regards to GDPR.
Regarding the security issue: While I cannot easily retrieve the AWS link through infinity as easy as before, I still can access any attachment without login on to AWS as long as I know the link structure: https://###########.amazonaws.com/item-files/digit-code/letter-code.file-ending So still anyone with the link can access my data. I´m not sure whether that means that any robot scanning your AWS address will also be able to access, but I assume that it´s possible, because it´s not password protected. So that´s probably still a no go for confident business data, not to speak of personal data especially payment information in regards to GDPR.
@micck - thank you for finding this huge security issue. @coa For me this finding is an absolute nightmare, because it means everyone can access sensitive data from every Infinity user. Why and how? Let me explain:
The link shows a few important facts for an attacker:
1.) the AWS datacenter used by Infinity
2.) (as it looks to me) a unique user or workspace number (micck called this the digit-code)
3.) Also the letter code seems to have a fixed length or at least a length range
So what could happen here is: an attacker could spawn a few hundred AWS Lambda instances in the same AWS datacenter and brute force every combination for files to get all files from every Infinity user. Because the attacker would be located in the same datacenter this attack would run at an incredible speed. AWS doesnât charge for traffic which occurs in the same datacenter so this attack is very cheap. And the Infinity team wouldnât have any chance to detect or stop this (because these requests and the traffic are completely handled by Amazon beside any checks from the infinity servers).
How to fix this? (I hope I can give some advice - I just want to help)
1.) The infinity team has to code some kind of proxy file for their server. Every file link has to point to this proxy file instead directly to AWS S3 -> https://startinfinity.com/proxy?workspace=digit-code&file=letter-code.file-ending
2.) All S3 storage on AWS must be set to private - no external access allowed
3.) Only the proxy code should know the credentials to access the S3 storage
4.) When some requests a file from the proxy it has to check if the user is logged in and has the needed right to access these files (no possibility to access other users files) and then it could deliver/stream the requested file back to the user.
This change should be possible in less then a week. I think the Infinity team must inform every user that there was a chance someone already has accessed all files.
I really need a statement from the Infinity regarding this issue. I hope fixing this issue is the highest priority at the moment.
I right click on a file and grab the direct link to it, I then use this link to share / embed the file directly on another page. For me it is like having publicly viewable file hosting.
Airtable has this feature of grabbing a direct link to the file stored in their database.
Iâll need to be 100% honest and say that this isnât my strong point, so I donât completely understand the issue, although I acknowledged the fact that it can cause huge issues in data leak.
Iâll do my best to make this a priority and notify the whole team.
We now lost our champion coa and I could not find anything regarding this on other discussions or the roadmap.
I have created a new entry on the public roadmap and I hope youâd care to vote it up too.
I just hope that I have not made it worse mentioning the security hole on the public roadmap.
Hey @j11,
that´s a good idea especially since the name of this thread is misleading. I already voted for it.
At least the server link is not visible anymore. I also thinks this has to have highest priority.
I just checked with Trello and the files there are also accessible without login once you have the link. So they have the same problem - maybe it´s a feature
@stefan@Jovana Maybe the infinity team will tell us more about this issue here next week!?
After checking out @micckâs last reply, I actually spoke to our product manager and she told me that this should be working now without any security problems. However, after checking, I noticed this is not the case. So it turned out that there was an oversight on our dev teamâs part and the task is back in their hands. Hopefully, it will be dealt with and fixed soon.
Have up voted this as well. Unfortunately the Roadmap is suffering from first in items being seen by the most people, and new items near the bottom of the list being neglected.
@CodeKnight: Agree. And there are quite a lot duplicates. It would be great if the infinity team would clean that up, also add a date to the the âinvalid dateâ items and make the âMost Recentâ Tab the Start View.
FYI, the attachment links remain working even after the items are deleted in âTrashâ.
I canât control the access to the files ever uploaded to Infinity.
This is really concerning.
@j11 I also contacted chat support for this issue last week. They wanted to get back to me after checking with the team, but I think they might sidetracked by the big updates they rolled out this week. I let you know as soon as I get a reply.
I just had a word with the product manager regarding this topic, and I urged the dev team to take up the task again as soon as possible! And once again I want to thank you for your patience!
I have scheduled a task for me in two weeks to follow up on this.
Hi @j11 and @micck, sorry about the wait on this. Apparently, our CTO had to work on this personally which by itself means itâs going to take a bit more time as he has a lot on his plate.
Once he deployed the âfixâ a few weeks ago we realized that it wasnât actually working as it should and it was put back on his to-do list. But by that time, he already had dozens of other things that needed his attention.
Anyway, the support team and I have urged the dev team to focus on this once again and raise its priority, and hopefully fix this once and for all. The information I have is that this should be worked on next week.
Thanks for your patience and I honestly hope Iâll be able to update you next week with some good news.
Though it doesn´t work in the item-detailed-view. I agree that should be more consistent. I would also suggest that the filename is shown quicker, so if you need to check out 5 pdfs you don´t have to spend 10-15 seconds on it. For images it´s easy to see, because you have the thumbnails.
The information I have is that this should be worked on next week.