This thread made me realize that we should probably have an option to PREVENT collaborators (particularly read-only collaborators) from being able to easily duplicate an entire base.
When we share read-only links to bases or views, we have that option that we can uncheck that says: โAllow viewers to copy the data in this baseโ or โAllow viewers to copy data out of this viewโ.
But it would be nice if we had that same feature for collaborators.
Hahaha! Bill, thatโs a solid 7.5 difference!! How did you accomplish this amazing feat!?!? :stuck_out_tongue_winking_eye: I have several friends who would love to learn this trick from you! :winking_face:
My answer to your overarching question is this, and I apologize if I havenโt made this clear earlier:
All collaborators, even read-only collaborators, can instantly download an entire table as a CSV file. But โ drum roll, please โ all of those dl.airtable.com links are a part of the CSV file. Those are the underlying URLโs that have no protection. So, with one click of the mouse button, any collaborator (even a read-only collaborator) has access to ALL the underlying unprotected URLโs in the entire table.
And THIS is the crux of the problem. Itโs actually tied into the other security issues, which is that read-only collaborators can instantly download an entire table (or duplicate an entire base) with one click.
In essence, Stacker solves the majority of these security issues, because collaborators can only grab ONE underlying URL at a time.
None of this is probably that big of a deal for MOST people. I just donโt like losing business due to security issues like this. :stuck_out_tongue: And I know that Airtable probably doesnโt like losing business, either. But when I get calls from law firms that ask me โHow safe our are attachments in Airtable?โ, I have to go down this whole rabbit hole with them and explain these potential issues.
p.s. Regarding Google, good point about how the link actually IS public when choosing that one option that they provide to people. Many people donโt realize that when they choose that option.
Indeed. I handle this a bit differently. I simply say -
It is not unlike the exposure most businesses currently endure with G-Suite.
Two quick side-bar commentsโฆ
If security is critical, attachments are not where you want to place sensitive documents.
Any business attempting to blend sensitive documents into their data should consider hosting them by reference (URL), not value (copies of the sensitive documents).
As to #2 - a secure document in Google Drive will require authentication even when published in a fully open database in Airtable. Making copies of any sensitive information should always be guided by business policy which for most firms, it is frowned upon.
As to #1, Airtable made attachments very flexible because document management is a difficult science; they built what we (generally) asked them to build.
We cannot blame Airtable for these constraints or unintended uses of the product. At some point, users must take responsibility because Airtable has provided a reasoned and relatively secure collection of protective measures to make safe applications.
Correct. They donโt, just as Airtable users generally donโt understand the underlying loosely-configured mechanics. And given this, when was the last time Google was hauled into CNBC to explain why sensitive Drive documents were breached? 2006 to date and not a single instance. Same for Airtable - 2015 to date; not a single instance.
Thank you. Like I said - I cannot explain it. 38+yrs of marriage and so far sheโs exhibited no interest in fleeing. From time-to-time she has mentioned that sentiment could change.
One of the solutions I could think of is when AirTable database is shared with a collaborator, the collaborator works on the same data, however, the links would be completely different for the same document.
In other words, if the owner would look at the document link, the link would be different than the link to the same document that the collaborator would see. Yet, both links would point to the same document.
When the owner decides to stop sharing the database, the collaboratorโs version of the links will be dead going to nowhere.
Added benefit would be traceability to see if somebody is downloading the attachments from the collaboratorโs database in a batch.
Secondly, an adjustment AirTable could do is to fine-tune what an editor and collaborator is allowed or not allowed to do (see the links or not see them, allow 3rd party apps like Zapier to see the links in the collaboratorโs version of the database or not allow to see them).
Maybe this could save the sheep and feed the wolf.
The only way to achieve 100% security model the way listed in the OPโs AirTable Security Manifesto would be to require login (or be logged in) every time anybody tries to access a document in AirTable.
Not only would this mean some inconvenience (and break functionality like described earlier) but even AirTable wouldnโt work as expected. Take for example the Gallery view. One of the useful ways that Gallery appears to being promoted by some perhaps to offer an a view of the data to the external world (e.g. customers for instance).
In my case, I turned the Gallery view to my private Classified site / eStore. I am even intending to add payment links to it through Zapier or similar. My idea is to turn AirTable to a poor manโs version of Pinterest / OfferUp.
If somebody wants to make copies of all the attachments, they could do that with a web-crawler.
So to summarize my view:
For AirTable to satisfy both the sheep and the wolf, they would need to fine-tune whether collaborators and viewers are able or note able to make a copy of the database, export database, access through Zapier, see links. Secondly, if people I trust have access to the links, the links should be unique to the person I shared with (regardless whether the links can be accessed by logging in or without logging in to AirTable).
Lastly, for all those other situations where people potentially have copy to the data in AirTableโฆ well there are NDA agreements. In particular, if AirTable generated version of links that is unique to the individual I share with, that information would point to the particular individual who had misused that (download log in AirTable or something similar).
This concept has been around for a long time and is ostensibly a โsigned URLโ - a URL that is distinct and immutable for a given user and often for a specific time period. Links like this should also have a shelf-life that can easily be controlled with an expiration date or access duration. I recommended this to the team about a year ago.
And not far from going a full blown blockchain ethereum supported solution too :winking_face: And imagine you could now integrate micropayments too to get paid. Yay.
I hope you three know how much I love and learn from reading your discussions. Thank you for keeping it civil yet heated :grinning_face_with_big_eyes: The collective knowledge and sincerity displayed on this forum is one of the best things about Airtable!
