Open max-mapper opened 9 years ago
I feel like a passwordless design would work nicely here.
Instead of generating a room with a random name, here is the process:
If the host gets a JWT that it verified, it knows that it generated it, so that it could only come from the email account whose address is in the JWT.
This design would be safer than user-generated passwords, the two most sensitive points being:
I wanna add a password feature to invites. Currently anyone with your invite code can control your computer.
when you create an invite it should ask if you wanna password protect it
if you choose yes, you have to enter a password.
we then use the password to AES encrypt the SDP before it gets uploaded to the lobby
If you don't specify a password you should a clear warning like 'Anyone with this room name will be able to join and see your screen'