Allow authenticated users to bypass the allow-list

[seanh]

1. If a user is logged-in to h then allow them to bypass the allow-list and proxy any page

2. If a user is not logged-in they will still get blocked by the allow-list, but the block page will now tell them that they can annotate the site if they log in or sign up (with either a link to a log in / sign up form or even one directly in the page)

3. The blocklist will still apply, even to logged-in users

Pros

• This should still prevent Via from being abused for phishing, malware, etc because unauthenticated users will see a Hypothesis page not the phishing or malware page

• This would remove allow-list-created friction entirely for authenticated users.

Cons

• When an authenticated user shares a Via link and unauthenticated users click on it (or when an unauthenticated user just tries to use Via directly) there will still be some friction: the unauthenticated user will be asked to log in or sign up. But that may be the lowest-friction we can actually manage?

• Users who are logged in to Hypothesis would be vulnerable to Via-based phishing/malware/etc :) However, various other ideas that we've had could help to mitigate this: opening the sidebar automatically in Via; showing a banner; preventing following links or submitting forms within Via, etc etc. See the Prevent unwanted uses of Via milestone

[robertknight]

Users who are logged in to Hypothesis would be vulnerable to Via-based phishing/malware/etc :)

We could perhaps add some kind of interstitial page that is presented to logged-in users telling them that they are about to visit a proxied page. Conceptually this would serve a similar purpose to a Via banner, but it would be more visible.

In other words, the various flows of visitors would be like this:

Any user visits allowed page: Visit proxied URL => Proxied page presented
Logged-out user visits non-allowed page: Visits proxied URL => Prompted to signup / log in => Proxied page presented
Logged-in user visits not-allowed page: Visits proxied URL => Shown interstitial page with a button to continue => Proxied page presented