flute
flute copied to clipboard
Add replay protection to flute packets
We added a replay-protection counter to KEY_TRANSPORT. This protects you against replay attacks if you've already seen a KEY_TRANSPORT before. It does not protect new members of a room, but still it's much better than nothing.
We should do the same for the ROOM_MESSAGE packet.
And we should consider adding a timestamp or some local info (like channel, nickname, server) to the ROOM_JOIN packet to make that harder to replay as well.
(See the "Replay Attacks" section on the spec for more info on replay attacks).