How JamCast keeps your signs yours.
A sign on your network and an account in the cloud. Here is how each is protected today, and what we have not done yet.
Your account
- Passwords are never stored. We keep a salted PBKDF2 hash (SHA-256, 100,000 iterations).
- Sessions use signed tokens, and the web app and API are served over HTTPS.
Your signs
- Each sign has its own credentials, issued when it is provisioned. One sign cannot speak for another.
- A sign joins an account only with its claim code. Once a sign is claimed, no other account can claim it.
- Your home Wi-Fi password is entered on the sign's own setup page, over the sign's own network, and stays on the sign.
Updates
- Signs fetch updates from JamCast's servers over HTTPS. Update packages can carry a SHA-256 checksum that the sign verifies before installing.
- The sign keeps a backup of the previous version when it installs an update.
What we have not done yet
JamCast has not had an independent security audit or a certification such as SOC 2. We will say so here when that changes.
Report a problem
Found a vulnerability? Email michael@sanfordlabs.io with the details. Please give us a reasonable chance to fix it before you share it publicly.