all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Dominik Csapak <d.csapak@proxmox.com>
To: Thomas Lamprecht <t.lamprecht@proxmox.com>,
	Dietmar Maurer <dietmar@proxmox.com>,
	pmg-devel@lists.proxmox.com
Subject: Re: [pmg-devel] [PATCH pmg-api/gui] add quarantine self service button
Date: Wed, 18 Nov 2020 08:56:25 +0100	[thread overview]
Message-ID: <31d52e9d-fe70-acdb-b24c-3554df4c3b13@proxmox.com> (raw)
In-Reply-To: <febff702-2986-c67f-7cbb-79b524b09029@proxmox.com>

On 11/18/20 8:44 AM, Thomas Lamprecht wrote:
> On 17.11.20 17:38, Dietmar Maurer wrote:
>>
>>> On 11/17/2020 5:27 PM Dietmar Maurer <dietmar@proxmox.com> wrote:
>>>
>>>   
>>> IMHO this is too dangerous.
>>>
>>> This needs at least some kind of captcha ...
>>
>> i.e. This would allow direct DOS attacks to the internal mail server.
>>
> 
> I found this captcha solution, relatively sophisticated but not a PITA for the
> (human) user, Friendly Captcha[0] used by some official European Union websites.
> 
> It uses Proof of Work[2] (i.e. crypto puzzel ones device needs to solve by
> computation), the specific library used is "Friendly PoW"[1].
> 
> If we go for a captcha I'd like something like this (could be rebuild), as
> it avoids the issues with picture texts (easily solved by computers, bad
> accessibility for humans) and similar captchas.
> 
> 
> [0]: https://github.com/friendlycaptcha/friendly-challenge
> [1]: https://github.com/friendlycaptcha/friendly-pow
> [2]: https://de.wikipedia.org/wiki/Proof_of_Work
> 

i'd rather go with a rate limited approach
e.g. a file with a
mail -> last click time
mapping
and refuse if the last click time is not older than 5min ?
and only 1 per 5 seconds overall?

a captcha would be much harder to implement (more dependencies,
backend as well as dependent frontend code and in this example
it seems the code is only available for js/ts), though
if we find a simple solution, i am not against it




  reply	other threads:[~2020-11-18  7:56 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-17 14:57 Dominik Csapak
2020-11-17 14:57 ` [pmg-devel] [PATCH pmg-api v2 1/3] refactor domain_regex to Utils Dominik Csapak
2020-11-17 14:57 ` [pmg-devel] [PATCH pmg-api v2 2/3] add 'quarantinelink' to spamquar config Dominik Csapak
2020-11-17 14:57 ` [pmg-devel] [PATCH pmg-api v2 3/3] api2/quarantine: add global sendlink api call Dominik Csapak
2020-11-17 14:57 ` [pmg-devel] [PATCH pmg-gui v2 1/1] add 'Request Quarantine Link' Button to LoginView Dominik Csapak
2020-11-17 15:29 ` [pmg-devel] [PATCH pmg-api/gui] add quarantine self service button Thomas Lamprecht
2020-11-17 15:53   ` Dominik Csapak
2020-11-17 16:11     ` Thomas Lamprecht
2020-11-17 16:00 ` Stoiko Ivanov
2020-11-17 16:27 ` Dietmar Maurer
2020-11-17 16:38   ` Dietmar Maurer
2020-11-18  7:44     ` Thomas Lamprecht
2020-11-18  7:56       ` Dominik Csapak [this message]
2020-11-18  8:01         ` Thomas Lamprecht
2020-11-18  8:13           ` Dominik Csapak
  -- strict thread matches above, loose matches on Subject: below --
2020-11-17  8:05 Dominik Csapak
2020-11-17 13:16 ` Stoiko Ivanov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=31d52e9d-fe70-acdb-b24c-3554df4c3b13@proxmox.com \
    --to=d.csapak@proxmox.com \
    --cc=dietmar@proxmox.com \
    --cc=pmg-devel@lists.proxmox.com \
    --cc=t.lamprecht@proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal