Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

重制鉴权 #1139

Closed
4 tasks done
88250 opened this issue Jan 17, 2021 · 3 comments
Closed
4 tasks done

重制鉴权 #1139

88250 opened this issue Jan 17, 2021 · 3 comments
Assignees
Labels
Milestone

Comments

@88250
Copy link
Member

88250 commented Jan 17, 2021

  • 默认监听 127.0.0.1,如果开启网络伺服功能则监听 0.0.0.0
  • 初始化时默认授权码为空,即不启用鉴权
  • 设置授权码以后启动需要输入,支持一键锁屏
  • API 调用需要鉴权
@88250 88250 added the Feature label Jan 17, 2021
@88250 88250 added this to the 0.6.4 milestone Jan 17, 2021
@88250 88250 modified the milestones: 0.6.4, 0.6.7 Jan 17, 2021
@88250 88250 changed the title 支持为笔记本设置访问授权码 支持为笔记本设置访问鉴权密码 Jan 18, 2021
@deerainw
Copy link

虽然不是什么值得骄傲的事,不过这个问题我可太有心得了...

一般来说用户需要这种锁定功能都是为了防止周围人的窥探,反正数据真加密是不可能的,那么更高效的做法应该是直接简单粗暴锁整个界面,就像印象笔记、wonderpen、standard notes 的界面密码锁一样。以我的使用经验来说,个人笔记加密这件事情上有一个比较违反直觉的逻辑,那就是加密的粒度越细、弊端越大。

因为对普通人的个人本地数据来说,无论是界面级别的锁定还是数据真加密,真正需要阻挡的并不是小偷小摸的人,而是「有足够权力直接要求自己交出设备和密钥的人」,所以笔记本的名字一开始就不能够暴露出去,举个轻松点的例子,比如说父母看到小孩有一个笔记本叫「我的早恋记录」并且是加密的,可能就直接男女双打逼供了。从要阻挡的人群上来说,如果未脱敏的笔记本名称暴露了,哪怕是全体文件用 AES-256 真加密也不管用,因为这种时候对方可能是有权力索要密钥的。如果加密细化到笔记本,用户为保险起见就需要给笔记本起一个脱敏的名字,如果加密再细化到单个文档,就需要给笔记本和同级目录的所有文档起各种脱敏的名字,这就是细粒度的弊端。

如果要做笔记本级别的鉴权密码,除了锁文件树和排除搜索,万一以后有新的入口也要记得去排除,首先开发上就更麻烦。对用户来说,有两个以上的私密笔记本时,每次冷启动之后挨个输密码也麻烦,如果加密配置不放在笔记本目录下的话换设备也麻烦。即使不说具体的功能实现, #710 描述的这个场景本身就很经不起推敲,存放了个人隐私日记的笔记软件怎么能让同事来直接上手操作...... 如果个人私密日记跟让同事来上手查的工作资料在同一个笔记本下,那笔记本级别的加密起不到作用,如果两者不在同一个笔记本下,直接关闭日记所在笔记本就行了。

包括 #1156 的分享鉴权密码,我觉得也是采用和 Obsidian Publish 一样的整站密码比较方便,在线分享也许比较适合笔记本级别的密码,但是现在使用这个分享功能的人应该很少,可以等用户们有这方面呼声了再考虑。

PS:以前总结过一小段 joplin 用户们就这个问题跟开发者的讨论,其实用户们心里也非常清楚数据真加密不太好弄,他们只是需要把界面锁一锁,能挡住身边绝大多数不懂技术的人就行了:https://www.yuque.com/deerain/gannbs/ta1oz1#TE7nq

@88250
Copy link
Member Author

88250 commented Jan 20, 2021

@deerainw 谢谢讨论,这块我们确实得再考虑下,锁屏应该能解决大部分场景。

@88250 88250 removed this from the 0.6.7 milestone Jan 20, 2021
@88250 88250 changed the title 支持为笔记本设置访问鉴权密码 应用锁屏密码 Jan 20, 2021
@hdg8087
Copy link

hdg8087 commented Mar 11, 2021

我的早恋日记,哈哈。
好可爱的名字。

@88250 88250 added this to the backlog milestone Jun 24, 2021
@88250 88250 pinned this issue Jul 25, 2021
@88250 88250 changed the title 应用锁屏密码 锁屏 Jul 25, 2021
@88250 88250 changed the title 锁屏 重新实现鉴权机制 Jul 25, 2021
@88250 88250 changed the title 重新实现鉴权机制 重制鉴权 Jul 25, 2021
@88250 88250 modified the milestones: backlog, 1.2.2 Jul 25, 2021
88250 added a commit to siyuan-note/appearance that referenced this issue Jul 25, 2021
88250 added a commit to siyuan-note/appearance that referenced this issue Jul 25, 2021
88250 added a commit to siyuan-note/siyuan-android that referenced this issue Jul 25, 2021
88250 added a commit to siyuan-note/appearance that referenced this issue Jul 25, 2021
Vanessa219 added a commit to siyuan-note/appearance that referenced this issue Jul 26, 2021
Vanessa219 added a commit to siyuan-note/user-guide-en_US that referenced this issue Jul 26, 2021
Vanessa219 added a commit to siyuan-note/user-guide-zh_CN that referenced this issue Jul 26, 2021
Vanessa219 added a commit to siyuan-note/appearance that referenced this issue Jul 26, 2021
@88250 88250 removed this from the 1.2.2 milestone Jul 26, 2021
@88250 88250 added this to the 1.2.2 milestone Jul 26, 2021
@88250 88250 closed this as completed Jul 26, 2021
@88250 88250 unpinned this issue Jul 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants