#26 User "Anonymous" can take (and keep) room keys

[Uwe Sinha]

An anonymous user can take keys "hung" to a room. If that key has sufficient privilege, any person in the world can deposit files in a CURE room and make them accessible to anyone else in the world. This way, a CURE installation can easily be abused as a host for illegal or otherwise dubious material.

Suggested short-term solution: explicitly forbid Anonymous to take or receive any key.

Suggested very short-term solution: forbid anonymous browsing in general.

Long-term solution: rethink the role of the Anonymous user.