Actually this is how the chromecast works. You never interact with the chromecast directly to configure your Netflix account for example. I assume (hope) they send a URL to the movie it should play with a one-time token to access the movie source.

It is inevitable that plaintext username/password will be used. This is why I am terrified.

Most likely it isn't a username/password but an authenticated URL... https://foo.bar.netflix.com/(UUID-OR-SIMILAR) where that is resolved to a resource, and the user authentication is valid for X hours from start...

There's no need for a plain username+password to be used... it's just an authentication token as the resource or part of the url.

They really just need to send the Netflix cookie from your browser to the chrome cast. But I don't think they do that, like sarnowski said, i believe they put some data in the url thats like a 1 time key for your account and the video you want to watch.

Are you really terrified that your Netflix username and password may be revealed? It's a bit much.

Don't people check their assumptions before asserting them as facts?

I don't know why it's a terrifying concept either.

Anyway, Chromecasts can be configured to allow guest access at the device level. Phones that are even on distinct networks can still guest-Chromecast via ultrasonic noises emitted by the Chromecast. It's pretty nifty. It's nice to have a bunch of people over and have a shared YouTube queue. For more details (https://support.google.com/chromecast/answer/6109297?hl=en) expand the section "How do mobile devices connect with a Chromecast in guest mode?".

Not sure if it works with desktops/laptops, but there is a guest mode (disabled by default) in the settings (on the Android app) that allows anyone to add thing sto the player queue.

Only app I know for sure it works is Youtube. I'm not sure what other app handles it, maybe GPM and Spotify.