I'm working on an app that will run on a users TV and has a companion mobile app.
I wanted to present a QR code to my users from the the TV app, which is then scanned by the companion mobile app's camera. I was originally thinking of encoding a v4 UUID in the QR code and use it as a shared secret between the two apps. This value would uniquely identify that particular TV device.
Once the shared secrets have been exchanged, the apps would connect to my server via web sockets and listen/emit events for that UUID. There would be no other passwords or usernames. This web socket communication would be done using WSS/TLS.
This service is a very simple message transport system between the mobile app and the TV app. There is no database, no users, etc. All messages are straight passthrough.
How bad of an idea is this? If the shared secret is nearly impossible to guess, it seems pretty secure to me at first glance. Is there anyway I could make it more secure?
One idea I had was to use some form of TOTP. That system is based on a shared secret as well, but it uses a time based component to modify the secret before exchanging/comparing. This would prevent the exposure of my real secret and prevent replay attacks. However, for my application, I would need a time window much larger than traditional TOPT as I would like this key to be valid for more than a few seconds.