Hacker News Reader

This doesn't seem like something I'd market as secure. Couldn't someone randomly join your session through entering a random 6 digits? Seems like it would need to expire, have owners approve new connections, etc.

View on HN

Thank you for feedback! Theoretically it's possible, but it's not just digits, it's alphanumeric so the chance is very low. As another user suggested - I will add approval for new clients so it's not going to happen

Yea, don't get me wrong but bruteforcing is real and I am not sure if its quite secure even with alphanumerical. Again I can be wrong but I'd personally wager a little bit more focus on privacy while still keeping The convenience but of course there are trade offs and its hard to do it quite right.

Hope you figure it out though!

Good point, thank you

36^6 is 2,176,782,336, only a hair over 31 bits of entropy.

Unless you have some sort of throttling implemented, that's not really a lot and could probably be brute forced.

Throttling :)

Reply on news.ycombinator.com