I've been wondering if there were ways to make insecure protocols(such as HTTP and WS, but mostly WS [websocket]) more safe to deal with. I've came up with an idea to lower the chance of data being stolen, but I don't know how good it is, and would like to ask for more ideas, if someone has any.
My idea consists of the following:
As soon as a player connects, the server will generate a random password, consisting of 50 random letters(Upper case and lower case) and numbers, then will send it to the player and both will save(player will save as a variable, and the server saves as an new object within an object that represents said player connection. Both are deleted upon disconnection. Each player has its own password). After that, all info exchanged between player and server is first encrypted before sent, and then unencrypted locally ( its AES 128bits CTR encryption).
Does that help securing the connection between player and server? Or do hackers usually intercept messages between both since the first interaction? Also, what other things could I do to make communication between both safe, when not using WSS?
I ask all of this because I can't force everyone hosting a server in my game to use WSS protocol, as it requires certificate and a key generated through a process that can be quite complex for some, then I know that most won't do, or won't know how to.