Deprecation: Folder Invitation Links

Box Employee

 

Folder Invitation links (see screenshot below) will stop being supported in early May 2017. On this date, the folder invitation link will disappear from the folder settings page and existing folder invitation links will stop working.

 

box-image.png

 

Users will be able to achieve similar functionality with shared links. Shared links can be used as invitation links by enabling the setting "Allow anyone who can access this folder from a shared link to join as a collaborator" on the folder settings page (see screenshot below). If users in your enterprise have shared folder invitation links outside of Box, they should replace them with shared links with this setting enabled before early May 2017.

 

box-image (1).png

Comments
Regular Visitor

How do I change "Allow users to join as" condition other form Editor or Viewer?

Box Certified Professional

@sawaki,

 

Unfortunately those are the only choices Box is giving us. I believe it is a wholely inadquate substitute to the previous option.

 

 

Bob

Regular Visitor

I am not certain how the invitation restriction option is providing 'similar functionality' to collaborator invitation links. This is an all or nothing option which does not allow you to provide a download-only link separate from a collaborator link.  The only usable permission choice is "Editor" (download-only link already provides Viewer permission), which means when enabled anyone with access to the folder share can delete and modify files as well as upload them. I tried using Sharing -> Invite Collaborators option; aside from being very cumbersome it does not work.  Although it sends the same link to anyone you enter, it only works for people you have emailed.  For upload links in particular, this will not work since we rarely know who will need to upload to a given share.  Even if we do know the collaborators, having the outbound email generated from an automated source means the recipient will not know who it is coming from, will not be able to reply to it, and we will be unable to customize the message in any significant way.

 

Does anyone know why this core functionality was removed?  More importantly, how do we get this functionality restored?  Also, I had to search Google to find out about this - searching Box help was useless.  

MOA
Senior Member

So, we no longer have the ability to allow people to connect as collaborators on their end at all? Now every single person has to be manually added to a folder if we want them to have anything other than Viewer-level access?

 

This seems like a big step backwards - what is the reason that this function was removed? Why don't we have the option to restore if we still want it?

Box Certified Professional

@MOA and @MichaelLaxTKLAW,

 

You can still do a self-invite of a sort. In the folder settings you can check the setting that says "Allow anyone who can access this folder from a shared link to join as a collaborator". You can only give Editor or Viewer permissions. Presumably once they've joined you can tweak it to a different permission level if you needed something more fine-grained.

 

Let me say that I, too, am not pleased with this change. I also see it mostly as a step backwards in functionality. It was done for security reasons. At the start of the year, an article was posted on ThreatPost.com about Box’s supposed “data leakage flaw”. The Box security team wrote a response to clarify and describe steps taken. Subsequent to this, it seems Box determined that the security steps they took caused operational issues for customers. For example, we have situations where no user has owner permissions to a given account and this meant that no one had the ability to enable those links. Furthermore, any folder created prior to the changes had the link enabled and the owner would have to go in and remove it if they wanted to. This was problematic because anyone with Editor permissions or higher could go in and copy that link.

 

Having said all that, it is is not all bad. It does give us some functionality we did not have before. By virtue of the access level restrictions on shared links I can send a self-inviting link out that is only accessible to people in my company. This gets to the core of what was problematic with the old self-inviting links. Once released to the wild, they could go out to anyone.

 

HTH,

 

Bob

Regular Visitor
I reviewed the links you referenced, and it would appear the issue was the indexing of collaborator links which has since been disabled. The 'solution' fails to provide any additional security - if enabled it would allow everyone to be an editor to that share. With collaborator links we could send a download only link (no account required), as well as differentiate between viewer/uploader (most common) and editor. That is all gone. Using 'invitation restrictions' the option is either on or off for everyone. The 'invite collaborators' option has some of the same features as the collaborator link but does not work in most situations, and when it does work it is ugly and a pain to use. Example: We create a share for someone at our firm so a client can upload documents. We send them a download-only link and provide them a viewer/uploader link to send to the client. I have a template setup with instructions and screen shots that they can send. All of that is now gone. If we are able to get the email address, the invitation will no longer come from the person at our firm - or even from our firm - but from some generic no-reply email address, which has already been blocked three times by our spam filter. Given the number of phishing emails with links to folder shares, this is a non-starter. This needs to be corrected quickly.
Box Certified Professional

@MichaelLaxTKLAW,

 

I still believe there is some confusion and I apologize if I've contributed to it. In your last post you appear to conflate shared links with collaboration. These are two distinctly different things. You state "With collaborator links we could send a download only link (no account required)." Any level of collaboration requires a Box account. The only way to provide access to Box content to someone without requiring them to have a Box account is to create a shared link, set its access level to "People with the link" and either distribute it somehow (email, post on website, carrier pigeon, etc.) or use it to create an embed widget on a web page.

 

If you enable the shared link you've created to be used to allow those with the link to invite themselves as a collaborator, they will have to create a Box account to take advantage of that. I absolutely agree with you that this change has removed the ability to create one link that invites people to your folder at one collaboration permission level and another link for another permission level. That stinks and causes some problems. As I mentioned above though, it does give the ability to restrict who can access the link at all, an incremental improvement over the previous method.

 

I'd like to better understand your use case. Perhaps I am just confused by your terms, but in the Box context it is important to understand the distinction between sharing and collaboration.

  • Sharing is a one-way street. You send out a link giving people the ability to view, and possibly download, content. Sharing has different levels of access. 
  • Collaboration is a two-way street. Access is a given. Any collaborator has access, regardless of whether they are part of your organization or not. The variable is the level of permission they have been granted with that access.

In your example you state "We create a share for someone at our firm so a client can upload documents." If you want a user to be able to upload documents, regardless of whether they are part of your company or not, they have three ways to do that.

  1. Be a collaborator with a permission level that is sufficient to upload. (And this is not one of the options with this self-invitation method we are discussing.)
  2. Email to folder.
  3. An upload embed widget. 

The first method requires the user have a Box account. Even in the days before they dorked the self-inviting link functionality this was the case. The latter two methods do not require the user have an account. One of those two might work for you, I don't know.

 

As for the new method causing some concern over the origin of the email, you can still send the link yourself. There is no reason you have to use Box to generate the email of the shared link. In fact I never allow Box to send my shared links. I copy them into my own email, just as I did with the invitation links before they did away with them.

 

I don't disagree that we lost something when Box made this change. I do think they could have satisfied the security concern by clearing out the old invitation links rather than just doing away with them entirely. I don't think you are without options to accomplish what you need though. It just may take a shift to some different functionality. 

 

Regards,

 

Bob

Regular Visitor
There is a lot to respond to, but I will try to do my best. First, I did not properly differentiate between a shared link and collaborator link. This is a difference we used quite a bit - we could have a link, preferably password protected, that could be used to download items that did not require a Box account. For the same share, we could have a collaborator link to allow for uploading only, and another with editor permissions (could create folders, delete and update documents). Finally, we could have a co-owner link to use within our department only; this would allow anyone on the helpdesk to manage a given folder share even if they did not create it. ALL of this is gone.


Of the three options for uploading to a Box share, only the first one is going to work for us. Generally the *only* reason for creating a Box share is because the files are too large to email (this takes out option 2). Option 3 would require maintaining a dedicated site to publish these embedded links, which is one of the reasons for using Box instead of hosting our own file share.


You mentioned the collaborator link can be created without it having to be sent from Box. I have tried this; first by trying to send the invitation to link to myself, which is not allowed (sort of makes sense), then by sending the link to a couple co-workers. While I realized they received the same link, when I had someone else try to use this link it did not work. The only to allow someone collaborator access is to send them a collaborator invitation, and the only way that I can see to do that is to have Box send it. So far this has been almost useless; when we know the invitation has been sent we have to monitor our spam filter just to be able to see it, and this can take at 15 to 20 minutes.


This will seriously impact our ability to deliver service to our customers and their clients. I expect prompt action to restore this functionality.


Michael Lax

Box Certified Professional

@MichaelLaxTKLAW,

 

I think you have a compelling use case that sums up many of the issues with Box's decision.I support your desire to have them restore that functionality. Have you submitted a ticket to Box to get a specific response?

 

I apologize for the confusion. I was talking about sending shared links. You are correct that a collaboration link has to come from Box.

 

Best of luck. 

 

Bob