Re:Google Cast is now built-in to Chrome
by sarnowski on Monday August 29, 2016 @03:05PM
(#12384326)
Actually this is how the chromecast works. You never interact with the chromecast directly to configure your Netflix account for example. I assume (hope) they send a URL to the movie it should play with a one-time token to access the movie source.
[ Parent
| on HN ]
It is inevitable that plaintext username/password will be used. This is why I am terrified.
Most likely it isn't a username/password but an authenticated URL... https://foo.bar.netflix.com/(UUID-OR-SIMILAR) where that is resolved to a resource, and the user authentication is valid for X hours from start...
There's no need for a plain username+password to be used... it's just an authentication token as the resource or part of the url.
They really just need to send the Netflix cookie from your browser to the chrome cast. But I don't think they do that, like sarnowski said, i believe they put some data in the url thats like a 1 time key for your account and the video you want to watch.