I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this broadcasting is as follows:
I have made a new solution to avoid this privacy issue and I want your expert suggestions on it or also you can recommend with other approaches. The steps are below:
1 When users come online, assign him random channel name and encryption key 2 This channel name and encryption key is known by only server and the receiver's browsers 3 Sender do not know the channel name and encryption key, he posts message on server with receivers unique id or username 4 Server saves the message into database, encrypts it with receiver's key and sends on his channel 5 Receiver will receive message on his channel and decrypt it with his key.
Is this approach right? If no, what should be alternative and efficient approach? What kind of vulnerabilities might be there?
Appropriate edits, comments and answers will be highly appreciated.