AppCode
 
2022.2
Shortcuts: macOS
Get AppCode
You are viewing the documentation for an earlier version of AppCode.
  1. Code With Me
  2. Code With Me security overview

Code With Me security overview

Last modified: 22 August 2022

Code With Me is a powerful tool that gives you an ability to collaboratively work on your code. With that ability comes responsibility to keep your code and level of access secure.

Code With Me workflow

Connection workflow

Let's say we have two users that want to connect to each other using Code With Me.

Data encryption

During a session, a host and a guest exchange private information including source code, passwords, and so on.

That is why the connection between a host and a guest is end-to-end encrypted using TLS 1.3. Whether the traffic flows between users directly, or through JetBrains relay servers, no third party, including JetBrains, can access this communication channel.

Code With Me encrypted channel

note

When several guests connect to a session, the host has a separate end-to-end encryption with each guest. However, the pin code verification is difficult when there are many guests connecting to a session simultaneously.

Protection against Man-in-the-Middle (MitM) attacks

Arguably, the biggest risk is malicious actors impersonating either the host or the guest to access the communication channel, or so called Man-in-the-Middle attacks.

Impersonating a legitimate host

Hacker is impersonating a legitimate host

In the beginning of the connection, both a guest and a host generate a unique SSL certificate consisting of a public and a private sections. The guest and the host are authenticated by this pair of SSL certificates.

A join link contains a fingerprint of the host’s certificate, which is a hash of the public part of their SSL certificate. No one but the host holds a private section of this certificate. So, a guest cannot physically connect to a malicious actor, impersonating a host.

Impersonating a legitimate guest

Hacker is impersonating a legitimate guest

Let's say a host created a link that leaked. For example, the host shared the link in a public channel.

So, if a host is not sure of the guest who is trying to connect to the created session, the host can check a pin code. The pin code must match the one of a guest. A host should check that a guest can name the pin code displayed on the host's side using any available channel. If the pin code matches, then the user who is trying to connect to the session is the legitimate one.

Audio and video calls encryption

The audio and video calls between two participants are not end-to-end encrypted by default, but it can be enabled in the call security options.

Enable end-to-end encryption

  1. After the session has started, on the right toolbar, click Code With Me to open the Code With Me tool window.

  2. On the Voice Call tab, on the tool window's menu, click the More Actions icon.

  3. From the list of available options, select Security options.

    Security Options

    You can add a password for your audio or video call so it can be password protected. You can also use the Enable End-to-End Encryption option to encrypt your call.

    Enabled Security Options

note

Keep in mind that the audio and video calls for more than two participants such as video conferences are not end-to-end encrypted. However, such encryption is in development.