kouchat
kouchat copied to clipboard
Impostor security
Sending data without some system of verifying the sender can be reverse engineered and may allow hackers to send data as someone else. Take this example:
- The hacker receives a message with the sender's identifier (userCode)
- The hacker sends a message changing his sender's identifier to the previously received one.
- Sent message appears to be from the original sender instead of hacker
You are right that there is no proper support for securing messages. This issue would probably be solved with encryption, as suggested in issue #5.
Doing as you suggest may look suspicious though, as the user being hijacked would appear to change ip address back and forth.