Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use 'App folder' dropbox permission to restrict Tusk's access to a single folder in user's dropbox #131

Open
1 of 3 tasks
antipasta opened this issue Apr 2, 2018 · 1 comment

Comments

@antipasta
Copy link

This issue is a

  • bug
  • feature
  • question

Please describe the current behavior, and explain why it's bad.

Dropbox support currently requires full read/write permission to all files in dropbox. This is a potential security risk if you have other sensitive files in your dropbox, especially since Tusk only needs access to the keepass db.

Please describe how you think it should change.

Provide the option for the 'app folder' dropbox permission, which creates a folder in the user's dropbox that the user moves files into to give Tusk access to them. This would fulfill the principle of least privilege for users that don't mind keeping their keepass db in Tusk's dropbox app folder. https://www.dropbox.com/developers/reference/developer-guide#app-permissions

@antipasta antipasta changed the title Use 'App folder' dropbox permission to restrict Tusk's access to user's entire dropbox Use 'App folder' dropbox permission to restrict Tusk's access to a single folder in user's dropbox Apr 2, 2018
@subdavis
Copy link
Owner

subdavis commented Apr 2, 2018

If you'd like to fully limit Tusks access to Dropbox, you should use a shared link. Get a shared link for your KeePass database and paste it into the shared link provider. Tusk will not be able to read any other file in Dropbox, and won't even need oAuth API access.

Thanks for the feature request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants