Email Notifications

[glenn-sorrentino]

User Story:
As a tip line owner, I want an email notification when a message comes in to Hush Line, but do not want the full message contents delivered to me, so I can know when I need to log in to check on a new deposit.

Acceptance Criteria:

• In Settings, a user can enable email notifications.
• In the same section, the user can enable full-message delivery.
• Notifications becomes its own tab
• Encryption settings becomes its own tab

Mockup:

[brassy-endomorph]

The mockup here 404's. Can you re-upload it so I can more clearly see what's going on?

[brassy-endomorph]

I want an email notification when a message comes in to Hush Line
...
In the same section, the user can enable full-message delivery.

Both of these have significant security implications in terms of metadata. One says exactly when a user visited the site, and one gives a suggestion for the message size. I think we need to make a publicly documented threat model that explains who/what we protect against so that people could (theoretically) decide whether the protection we offer is sufficient or not. Or if someone wanted to review our code they could meaningfully determine whether we're achieving our goals, because as it is without a specification, we can just say "oh but that's allowed" to any leakage of information someone might point out

[glenn-sorrentino]

The mockup here 404's. Can you re-upload it so I can more clearly see what's going on?

Not 404ing for me - here it is again:

[glenn-sorrentino]

I want an email notification when a message comes in to Hush Line
...
In the same section, the user can enable full-message delivery.

Both of these have significant security implications in terms of metadata. One says exactly when a user visited the site, and one gives a suggestion for the message size. I think we need to make a publicly documented threat model that explains who/what we protect against so that people could (theoretically) decide whether the protection we offer is sufficient or not. Or if someone wanted to review our code they could meaningfully determine whether we're achieving our goals, because as it is without a specification, we can just say "oh but that's allowed" to any leakage of information someone might point out

So we already forward messages. This new feature will actually give more secure options.

Most importantly, this is a customer-requested/funded feature and cannot be held up because of a document. If you think that time correlation is an issue, build in a random timer for when notifications are sent. Same with size - we can add variable dummy text to messages.