Jitsi Meet: warn data is decrypted on the server #1728

New Issue

2020-02-20T16:15:27Z

lrq3000 commented

2020-02-20 16:15:27 +00:00

(Migrated from github.com)

Description

Jitsi Meet currently does not support end-to-end encryption, because noone found a way to implement multi-party voice/video encryption through WebRTC.

Data is encrypted from the clients to the server, then the server decrypts all data and dispatches back to the clients.

They use Google analytics when connecting to Jitsi Meet to capture user data, such as the room name.

I do not think Jitsi Meet should be delisted, it's a great software, but it's clearly not the most private messaging/videoconferencing tool, I suggest to add a warning.

## Description Jitsi Meet currently [does not support end-to-end encryption](https://github.com/jitsi/jitsi-meet/issues/409), because noone found a way to implement multi-party voice/video encryption through WebRTC. Data is encrypted from the clients to the server, then the [server decrypts all data](https://github.com/jitsi/jitsi-meet/issues/409) and dispatches back to the clients. They use Google analytics when connecting to Jitsi Meet to capture user data, such as the [room name](https://github.com/jitsi/jitsi-meet/issues/4590). I do not think Jitsi Meet should be delisted, it's a great software, but it's clearly not the most private messaging/videoconferencing tool, I suggest to add a warning.

👍 3 👀 1

emcho commented

2020-04-05 23:00:59 +00:00

(Migrated from github.com)

If I may:

but it's clearly not the most private messaging/videoconferencing tool

It actually is pretty much the secure video conferencing tool. While indeed it is not e2ee encrypted (and that will soon change), it is the only one that allows complete deployment in ones own server in a very short period of time (under 15 minutes).

Because it encrypts all communication on the wire, owning your own Jitsi Meet server provides similar protection to end-to-end encryption.

You can see Edward Snowden talking about setting up your own Jitsi Meet server as a good practice in his interview with Radio France Inter here:

https://youtu.be/MQmntYFKrX4?t=124

You can see Bruce Schneier recommending Jitsi Meet here (bottom of post):
https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html

If I may: > but it's clearly not the most private messaging/videoconferencing tool It actually *is* pretty much the secure video conferencing tool. While indeed it is not e2ee encrypted (and that will soon change), it is the only one that allows complete deployment in ones own server in a very short period of time (under 15 minutes). Because it encrypts all communication on the wire, owning your own Jitsi Meet server provides similar protection to end-to-end encryption. You can see Edward Snowden talking about setting up your own Jitsi Meet server as a good practice in his interview with Radio France Inter here: https://youtu.be/MQmntYFKrX4?t=124 You can see Bruce Schneier recommending Jitsi Meet here (bottom of post): https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html

murillo128 commented

2020-04-05 23:36:21 +00:00

(Migrated from github.com)

FWIW e2ee will be possible in webrtc soon

https://webrtcbydralex.com/index.php/2020/03/30/secure-frames-sframes-end-to-end-media-encryption-with-webrtc-now-in-chrome/

FWIW e2ee will be possible in webrtc soon https://webrtcbydralex.com/index.php/2020/03/30/secure-frames-sframes-end-to-end-media-encryption-with-webrtc-now-in-chrome/

emcho commented

2020-04-05 23:54:58 +00:00

(Migrated from github.com)

And in Jitsi too ... FWIW ;)

Mikaela commented

2020-04-06 19:29:51 +00:00

(Migrated from github.com)

Do you have links to Jitsi Meet and Chromium (and Firefox?) tickets on this subject?

lrq3000 commented

2020-04-09 11:08:55 +00:00

(Migrated from github.com)

@emcho and @murillo128 : That is awesome! I love Jitsi Meet, it's a wonderful project, this issue is not meant to berate the project but simply allow the users to transparently assess whether the privacy provided by the software is sufficient for their needs.

About it being the most secure videoconferencing tool, I don't think that's the case, since if I understood correctly Jami has all communications E2EE, including videoconferencing (but it's not using webrtc, hence why they were not limited in that aspect). That said, Jitsi Meet is highly privacy friendly, it's in the top league for sure, particularly when self-hosted.

I am excited to hear that e2ee will be soon possible in webrtc, I'm really eager to see it :-)

@emcho and @murillo128 : That is awesome! I love Jitsi Meet, it's a wonderful project, this issue is not meant to berate the project but simply allow the users to transparently assess whether the privacy provided by the software is sufficient for their needs. About it being the most secure videoconferencing tool, I don't think that's the case, since if I understood correctly Jami has all communications E2EE, including videoconferencing (but it's not using webrtc, hence why they were not limited in that aspect). That said, Jitsi Meet is highly privacy friendly, it's in the top league for sure, particularly when self-hosted. I am excited to hear that e2ee will be soon possible in webrtc, I'm really eager to see it :-)

lrq3000 commented

2020-04-09 11:32:29 +00:00

(Migrated from github.com)

I have just read the link you provided @murillo128 , thanks a lot! That's very very promising! It indeed looks like Secure Frames / SFrames could solve the issue once and for all of multiparty E2EE!

However I fear it may not be soon for Jitsi Meet since this will probably require some major rewrite since media encryption means that all server-side media transcoding and other bandwidth optimization schemes will need to be redesigned to the client-side. So let's wait until that happens, I will follow the progress anyway :-)

I have just read the link you provided @murillo128 , thanks a lot! That's very very promising! It indeed looks like Secure Frames / SFrames could solve the issue once and for all of multiparty E2EE! However I fear it may not be soon for Jitsi Meet since this will probably require some major rewrite since media encryption means that all server-side media transcoding and other bandwidth optimization schemes will need to be redesigned to the client-side. So let's wait until that happens, I will follow the progress anyway :-)

lrq3000 commented

2020-04-14 12:39:46 +00:00

(Migrated from github.com)

If Jitsi can implement multiparty E2EE, that would certainly be a big plus in the field, considering other companies are plainly lying about their E2EE capabilities when in fact they are simply using TLS encryption as does Jitsi currently (but at least Jitsi is transparent about that).

https://protonmail.com/blog/zoom-privacy-issues/

If Jitsi can implement multiparty E2EE, that would certainly be a big plus in the field, considering other companies are plainly lying about their E2EE capabilities when in fact they are simply using TLS encryption as does Jitsi currently (but at least Jitsi is transparent about that). https://protonmail.com/blog/zoom-privacy-issues/

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#1728