3 ms·
Maybe I'm stupid but how are user IDs and chatroom IDs sensitive information? How can I join a room or interact with a user if I don't know the ID? Just trying
by Kiro 6y ago
Maybe I'm stupid but how are user IDs and chatroom IDs sensitive information? How can I join a room or interact with a user if I don't know the ID?
Just trying to understand the severity here and if I'm doing something wrong in my apps.
- josephg 6y agoUser IDs are sensitive because they can be used by internet service providers to track and identify users as they move through various networks. And they can be associated to figure out who your contacts are. As others have mentioned, the CCP could use this information to punish users for joining rooms they don’t like. The rule is, if ever in doubt, send all data through https. There is just about no reason to use unencrypted http or tcp in 2021.
- saladgnu054 6y agoYou can tell who is talking with whom.
- propogandist 6y agoSnowden exposed mass 'metadata' collection, most didn't seem to care, sadly.
- CydeWeys 6y agoWhy is your app sending anything over the network unencrypted? You're making HTTP requests (not HTTPS)??
- np_tedious 6y agoI think it's UDP. Probably for the audio
- CydeWeys 6y agoThat may be true of Clubhouse but not necessarily for the person I responded to. Anyway, there's plenty of ways to encrypt UDP, such as DTLS; see this RFC: https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347
- YarickR2 6y agoand why not ? Why do you insist everything should be encrypted ?
- tchalla 6y agoEverything can be sensitive if you don’t get informed consent.