Security

Applies to LESSRAM 0.1.x

Accounts and sessions

• Passwords are hashed with scrypt. Sign-in runs the same work for an unknown username as for a wrong password, so neither the response nor its timing reveals whether an account exists.
• Session tokens are 256-bit random values, stored hashed. A database leak yields no usable sessions.
• Changing your password signs out every other session.
• Your session token is held by the app's background process. The interface never sees it and cannot send it anywhere else.

Permissions

Every permission decision is made by the server, not the app. The interface hides buttons you should not press, but that is cosmetic — the server is the thing saying no, and there are automated tests that attempt each bypass and require it to fail.

Voice and screen sharing

Media is peer-to-peer and encrypted by WebRTC (DTLS-SRTP). The server relays only the handshake, and only between two people already in the same room, so a signed-in stranger cannot inject themselves into a call.

Files

An attachment is readable only by people who can see a message carrying it. Anything that is not a known-safe image or PDF is served as an inert download with sniffing disabled, so an uploaded HTML file can never run.

The app itself

The interface runs sandboxed, cannot open windows, cannot navigate away from the files it shipped with, and cannot reach the network directly.

What this does not protect against

• No end-to-end encryption. A server operator can read messages.
• A compromised device. Anything with access to your machine has access to your session.
• Invite codes are bearer credentials. Anyone with the code can join until it is revoked.

Reporting a problem

If you find a security issue, report it privately to the server operator rather than posting it publicly, and give them a reasonable window to fix it before disclosing.