I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this broadcasting is as follows:

1    Server publishes data on a channel say Test-channel when some appropriate event is fired
2    We retrieve data through Javascript using channel name on client side.

Now I want to use this broadcasting mechanism to implement private chatting just like that of Facebook. The problem I am seeing in this is privacy. It is possible to change the channel name in javascript to retrieve messages of others if we determine others' channel name or if we apply permutations for channel name and listen them on client with javascript.

I have made a new solution to avoid this privacy issue and I want your expert suggestions on it or also you can recommend with other approaches. The steps are below:

1    When users come online, assign him random channel name and encryption key
2    This channel name and encryption key is known by only server and the receiver's browsers 
3    Sender do not know the channel name and encryption key, he posts message on server with receivers unique id or username
4    Server saves the message into database, encrypts it with receiver's key and sends on his channel 
5    Receiver will receive message on his channel and decrypt it with his key. 

Is this approach right? If no, what should be alternative and efficient approach? What kind of vulnerabilities might be there?

Appropriate edits, comments and answers will be highly appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.