Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

  • PeriodicallyPedantic@lemmy.caEnglish
    72·
    2 days ago

    I’m kinda disappointed with this thread, I’m in a similar position to OP, but all the responses are just like “use a reverse proxy and make your URL hard to guess” and other measures which are not very secure. \

    It seems like that’s about as good as you can get at the moment, because the mobile apps barf if you try to add in auth in front of the reverse proxy, but a lot of people seem to be providing this advice like it’s good enough rather than as good as you can get.

    • frongt@lemmy.zipEnglish
      5·
      2 days ago

      Well yeah, the “good as you can get” answers are “use a VPN” or “don’t”.

    • KneeTitts@lemmy.worldEnglish
      31·
      2 days ago

      Im confused as to what people think the security issue is? Do they think someone will brute force their username and password with a billion queries?

      • mko@discuss.tchncs.deEnglish
        1·
        7 hours ago

        That’s assuming an attacker will play nice with URL forming and discovering edge cases in POSTing shaped data to the service. Just encrypting is still weak security if the whole front-end web and API surface isn’t hardened.