How can I generate a password (or hash), that can't be guessed, but it can be used to authenticate the client?
Possible solutions (or what have I thought / tried already)
1. Create a registration system for this service
I could add a registration form and a login form, and associate service user with YouTube user with some kind of verification, but that's too much hassle for the user. It's really just a basic service so this would be an overkill.
2. Make it closed source
Firefox add-ons are not necessarily open sourced. By making it closed sourced, I could do a simple trick like creating a costum hashing function (or just simply a costum salt for the hash) which is hidden by the closed source. This way I would generate a password direclty from the username. There are two options here:
a.) Create it as a C++ XPCOM component. I tried that. But turns out, this is also an overkill. It's very incompatible across gecko versions and I haven't even got to compile it across platforms. It's really hard to debug, there's almost no support at all and most importantly: I don't like the idea of maintaining a binary piece compiled for every version of Firefox for every platform just to have 5 line of code encapsulated in a 300 line interface. Also, what if I decide to port this add-on for Chrome? There's no such thing as XP-COM.
3.) Get password from YouTube
If I could get a code from YouTube, just as easily I am getting the username (get a dummy page in background and fetch the username from source code) I would be saved. But I can't. There's no way I could get the real password, maybe if it's saved I could get that way, but I can't base on that. Well, I don't need the real password anyway, anythings fine as long as it's a secret, it's unique to user and constant by user (every user has one and only one, available anytime).
a.) I searched YouTube's source code and the embedded player's parameters and found something, but wasn't secret. It was somewhere in the profile, and I could see other user's codes. So this means: I found nothing.
b.) I also checked the cookies. But after a re-log-in there was no cookie value that haven't changed it's value. Not that I could understand what cookie does what.
The problem with all these are that... they are so unprofessional. I posted this question in hope of some cool method invented for scenarios like this. A handshake or something.
I need this because I have to write a Terms of service for my add-on. And I can't just write inside that I'm saving your history to an external server for the benefit that you can use my add-on across many computers without any security, That anyone who downloads Fiddler, and knows what HTTP protocol is can simply view what videos have you watched.
Sorry for the question being so long, and sorry if it's off topic (I hope it's not).