openphoto/frontend — Issue #390: Privacy model, groups, permalinks, etc
Author: jmathai
Created: 2011-12-17 21:09:40+00:00
State: open

The privacy model needs to be both easy and flexible. There are lots of different options but the goal of OpenPhoto is to select the one which makes the most sense to the majority of users. I realize different users have different needs so we'll try to address those in this issue as well.

Simplicity

Having photos be public and private is the most simple permission model. This omits the option to share private photos with others. To solve that there are several options.

Groups

The identity system in OpenPhoto relies on verifying ownership of an email address. We currently do this using either BrowserID or Facebook. The login framework allows any service which confirms ownership of an email address to be supported.

Groups simply consist of any number of email addresses. A group can also simply be an email address for ease of use - it basically lets you share with an email address without having to "create a group".

Groups are the fundamental unit to share with.

Objects

When sharing you have to decide exactly what you're going to share. It can be your entire collection of photos, a single photo or a group of photos.

Sharing your entire photo collection is easy. We should consider how many users this method works for. It means that we add another type of permission which has the ability to view photos and leave comments.

Sharing a single photo can be done by having a unique URL for the photos. It's security by obscurity which should be fine. The unique URL can include some version of the hash and perhaps the secret.

Sharing a group of photos is more complicated. First, we don't have albums. We could do sets of tags which are represented as an album but the implementation of this is more complicated. I'm curious how often a group of photos need to be shared and one of the previous two options don't work.

Again, we have to solve for the majority here.

Authentication

A sharable link with an obfuscated URL should not require a user to log in. The obfuscated URL alone should be sufficient.