4 ms·
Does this introduce basic UX changes, like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate? Edit: A
by yunaflox 26d ago
Does this introduce basic UX changes, like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate?
Edit: And making it more secure? Just because it is commonly for LAN doesn't mean it can be insecure
- RajT88 26d agoIncluding, but not limited to, sending passwords in cleartext on login.
- post-it 26d agoAs opposed to what? The password needs to reach the server. Encryption is the job of HTTPS.
- izacus 26d ago... as opposed to using salted hashing like in every tutorial since 1990s.
- jack-cooper 26d agoI think you have some confusion between expectations upon the client and the server. This very site (and almost every other) sends your password in plaintext over form data when you sign in. Hashing (and/or salting) a password client-side before sending it would offer next to no protection, as if the server is expecting this value and the attacker intercepts it, they could just replay the hashed value themselves. Why would they need to know the original password? The salt for the password should also have been randomly generated when it was first created, and stored alongside the password in the database. The only way for the client to know this value would be to retrieve it based on username alone, when the request is first made. This would reduce the security of the system and allow a dedicated attacker much more leverage to try and crack that single password, if they knew only the username of the user. The comment you're replying to is correct, encryption is the job of HTTPS.
- Borealid 26d agoI don't think this is what the GP meant, but he's accidentally correct in that there is indeed no good reason for a password to reach the server. The client could do a challenge-response PAKE with the server, proving the client held the password while not transmitting it. The session cookie could be sent from the server as part of that exchange, encrypted so only the holder of the user's password could decrypt it. That's not how the web works, but it's strictly superior to the accepted standard of the client sending the raw password to the server, and it would be secure even over an active MITM unencrypted link.
- frez1 26d agoi believe the maintainers stance is that jellyfin should not be exposed and it should always be behind a vpn
- yunaflox 26d agoUnfortunately, yeah.
- unsnap_biceps 26d agoFrankly at this point, everything that is not explicitly fully public should be...
- alacritas0 26d agonot necessarily always a VPN, but you can also use a reverse proxy like caddy or nginx where encryption and security are primary concerns instead of something non-essential like in jellyfin.
- Mashimo 26d agoI doubt that, how would that work? You would need to give all your friends a VPN login into your local network for all of their devices, including TVs.
- mrheosuper 26d agoor your friend can setup VPN on his Router box.
- Mashimo 26d agoBut then all of his traffic goes through my internet. Unless he has a special high end router that can only route specific domains.
- mrheosuper 26d agoYou dont need high end box, a old mini pc running pfsense/opnsense is enough.
- Mashimo 26d ago> like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate? I don't know if that changed, but I gave jellyfin only read only access to my movies.