Edit: And making it more secure? Just because it is commonly for LAN doesn't mean it can be insecure
I don't know if that changed, but I gave jellyfin only read only access to my movies.
If you think most non tech people can just casually find an old pc, install and setup pfsense, then you are out of touch with reality. And they also would have to let it run all the time and have space for it. That's just not something realistic. It's not an option for my friends. Might also break chromecast.
Hashing (and/or salting) a password client-side before sending it would offer next to no protection, as if the server is expecting this value and the attacker intercepts it, they could just replay the hashed value themselves. Why would they need to know the original password?
The salt for the password should also have been randomly generated when it was first created, and stored alongside the password in the database. The only way for the client to know this value would be to retrieve it based on username alone, when the request is first made. This would reduce the security of the system and allow a dedicated attacker much more leverage to try and crack that single password, if they knew only the username of the user.
The comment you're replying to is correct, encryption is the job of HTTPS.
Just like all the updates before that.
Or release native clients that can use OIDC.
Doing neither sucks =[.
There have been exploits: https://github.com/jellyfin/jellyfin/security
The project is a fork of another project (Emby) and there has always been potential for user-supplied data ending up in command-line arguments, or exploitation of the (admin) user getting to upload various files. Nonetheless, all reported security bugs have been fixed promptly, and they're proactively sweeping through the full set of APIs they inherited, looking for possible exploit paths.
Most exploits required an authenticated user.
If you're concerned about this, you should run Jellyfin's docker image, with read-only mounts of your media library, and only give accounts to people you trust, which is how you should treat your personal media library anyway.
A lot of Jellyfin's API doesn't require any authentication at all, as an example.
> Is this a massive red-flag security risk that actively exposes your data to the Internet? No.
>
> At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above..