When you invite a guest to a project in Oroson and there are confidential items, security is your main priority. At Oroson, we want you to have peace of mind that only invited guests are able to access your Oroson project. However, we don't want to hinder the guest experience with pesky passwords.
Therefore, if you want to protect your projects and ensure only certain guests can access your project, you can do so by following these steps:
Click the share button in the top right
Ensure the share-link is disabled
Add the email address of the guest you'd like to invite
Optionally, add a message
Send the invite
Guests Magic Links for 'Comment and Upload' Permissions
When you update the permissions of your guest and give them 'Comment and Upload' privileges, your guests will have to verify their account for security reasons. This ensures that only select guests upload content to your project.
When a guest is given the permissions to upload content, we will send them an email inviting them to access the project with a magic link that is uniquely tied to their email.
Once the invite has been sent out, your invited guest will receive an email that looks something like this:
When they select the 'Take me there!' button, their account will be authenticated for 30-days, unless they clear their cookies or access Oroson from a new device. After that 30 days, when they try to access Oroson, they will be asked to enter their email and another magic link will be sent to them.
How secure are magic links?
Magic links are very secure because:
Magic links are only valid for 1 hour.
Magic links can only be used once.
Magic links are signed URLs with very strong entropy. This means they are almost impossible to guess as they provide the same level of security as a 100+ character password.
Magic links are tied to a single email, so no other user can use someones else's magic link to sign-in to their account.
What can a guest see?
All invited guests in Oroson can only see projects in which they are invited. They will not be able to access any other projects in Oroson without being explicitly invited or receiving a share-link. Guests can only see the active project, they are unable to see archived items.
How to see which guests have accessed your project?
To view who has accessed your project in Oroson, you can follow these steps:
Go to the project
Select the circle avatars in the top-right, this will open a drop-down
View the names and emails under 'Guests'
Invited means the user was invited via email but have yet to access the project. If there is no 'invited' under the email and you can change their permission levels, this means the user has accessed the project.
Let us know if you have any questions by reaching out to us on chat or emailing us at firstname.lastname@example.org! We're always happy to help!