Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

brie.fi

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#11

Post by perenzo »

clawoo wrote: post #8
perenzo wrote: post #7

Earlier quoted context omitted.

Correct. Scroll up the page to learn about the details: https://brie.fi/ng#help Also see https://webrtc-security.github.io/ WebRTC is end-to-end encrypted by default. There is a signaling server that helps establishing the connections between users in a room, but after that the communication is encrypted. Also those TURN and STUN servers are only required for technical reasons to get peer-to-peer working. So no conte…

I think you are very much misinformed on the subject. You're not sending unencrypted streams to Jitsi, as it uses hop-by-hop encryption, meaning you send an encrypted stream to the server where it gets decrypted and re-encrypted for the rest of the participants. At no point you are sending "plaintext" data. What you might have heard is that Jitsi will be introducing end-to-end encryption, but it doesn't mean it doesn…

I did not want to say Jitsi is bad. It is one of the best solutions around. But you still have to trust the server if e2ee is not turned on and more than 2 participants are using it [1]: "This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge"

I believe it is correct to say, that WebRTC is end-to-end encrypted. What you are referring to is, if you can trust to have a direct connection to the other participant and that you can make sure she is the person she pretends to be. This layer is indeed missing and will be added [2]

I would very much appreciate your help on the project to eliminate those concerns.

[1] https://jitsi.org/security/

[2] https://github.com/holtwick/briefing/issues/1

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#12

Post by perenzo »

tpetry wrote: post #9

How do you do the background? Are you using the bodypix tensorflow library? Because in my tests it had been horrible slow and very inaccurate depending on lighting,

That's correct, I use https://github.com/tensorflow/tfjs-models/tree/master/body-p...

It is indeed slow. The video signal first is drawn to a canvas and then from there streamed as a video again. Some browsers perform better than others. Probably due to WASM support, but I did not dig deeper here.

The "pro" though is it all happens on the client in the browser.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#13

Post by perenzo »

cryo wrote: post #10

I don't understand the anonymous claim. Since in WebRTC peers connect directly to each other they'll see the IP of the other peer and can determine their locations. Further there is the signalling server which may also see these connection details if it isn't end to end encrypted (I haven't checked the code). IMHO private might be a better word than anonymous here.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#14

Post by Lunrtick »

perenzo wrote: post #7
enneff wrote: post #6

Earlier quoted context omitted.

WebRTC is encrypted.

Correct. Scroll up the page to learn about the details: https://brie.fi/ng#help Also see https://webrtc-security.github.io/ WebRTC is end-to-end encrypted by default. There is a signaling server that helps establishing the connections between users in a room, but after that the communication is encrypted. Also those TURN and STUN servers are only required for technical reasons to get peer-to-peer working. So no conte…

Jitsi has end-to-end encryption now (used it a few days ago).

It behaves quite hilariously when you switch to e2e encryption after a normal connection - the other party gets random noise for a little while.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#15

Post by perenzo »

Lunrtick wrote: post #14
perenzo wrote: post #7

Earlier quoted context omitted.

Correct. Scroll up the page to learn about the details: https://brie.fi/ng#help Also see https://webrtc-security.github.io/ WebRTC is end-to-end encrypted by default. There is a signaling server that helps establishing the connections between users in a room, but after that the communication is encrypted. Also those TURN and STUN servers are only required for technical reasons to get peer-to-peer working. So no conte…

Jitsi has end-to-end encryption now (used it a few days ago). It behaves quite hilariously when you switch to e2e encryption after a normal connection - the other party gets random noise for a little while.

But it only works with Blink/Chrome right now because it depends on Insertable Streams:

https://jitsi.org/blog/e2ee/

https://www.chromestatus.com/feature/6321945865879552

Hopefully this will be implemented in other browsers as well soon.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#16

Post by clawoo »

perenzo wrote: post #11
clawoo wrote: post #8

Earlier quoted context omitted.

I think you are very much misinformed on the subject. You're not sending unencrypted streams to Jitsi, as it uses hop-by-hop encryption, meaning you send an encrypted stream to the server where it gets decrypted and re-encrypted for the rest of the participants. At no point you are sending "plaintext" data. What you might have heard is that Jitsi will be introducing end-to-end encryption, but it doesn't mean it doesn…

I did not want to say Jitsi is bad. It is one of the best solutions around. But you still have to trust the server if e2ee is not turned on and more than 2 participants are using it [1]: "This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge" I believe it is correct to say, that WebRTC is end-to-end encrypted. What you are referring to is, if you can trust to have a direct…

> This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge

What this means is that the packets are encrypted between you and the video bridge and the packets travel unencrypted within the videobridge infrastructure, but at no point does the outside world see the unencrypted stream. Talking to the Jitsi video bridge is just a regular WebRTC session as far as clients are concerned (so any DTLS encryption WebRTC has, the Jitsi call has), I know this because before they had a decent SDK I had to manually wedge my WebRTC calls into it.

If you're looking to add e2ee to your project, you're pretty much left to choose between Olm and Signal Protocol, which are quite similar, but libsignal is GPLv3 while libolm is Apache 2.0.

I've used Olm more intensively over the last two years. While it works, it's great, when it randomly wedges a session for no apparent reason you feel like throwing it out the window.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#17

Post by perenzo »

clawoo wrote: post #16
perenzo wrote: post #11

Earlier quoted context omitted.

I did not want to say Jitsi is bad. It is one of the best solutions around. But you still have to trust the server if e2ee is not turned on and more than 2 participants are using it [1]: "This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge" I believe it is correct to say, that WebRTC is end-to-end encrypted. What you are referring to is, if you can trust to have a direct…

> This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge What this means is that the packets are encrypted between you and the video bridge and the packets travel unencrypted within the videobridge infrastructure, but at no point does the outside world see the unencrypted stream. Talking to the Jitsi video bridge is just a regular WebRTC session as far as clients are concer…

Thanks for the feedback, I'll take Olm/Matrix and Signal into consideration, although I believe for the described purpose of Briefing the current implementation is sufficient and secure.

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#18

Post by walterbell »

perenzo wrote: post #13
cryo wrote: post #10

I don't understand the anonymous claim. Since in WebRTC peers connect directly to each other they'll see the IP of the other peer and can determine their locations. Further there is the signalling server which may also see these connection details if it isn't end to end encrypted (I haven't checked the code). IMHO private might be a better word than anonymous here.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

How about the term "unauthenticated", which is well understood for HTTP requests?

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#19

Post by perenzo »

walterbell wrote: post #18
perenzo wrote: post #13

Earlier quoted context omitted.

By using the term "anonymous" I wanted to say, that no user account is required. To hide one self's identity and network location I would expect the users to make use of browsers like Tor or using VPN. I don't know of any way to provide anonymity on web application level. If somebody knows more, please let me know.

How about the term "unauthenticated", which is well understood for HTTP requests?

Well, IMO the definition of the word "anonymous" still fits how personal information is handled in Briefing: "Anonymity describes situations where the acting person's name is unknown" [1] And this is true regarding the Briefing service.

[1] https://en.wikipedia.org/wiki/Anonymity

Re: Show HN: Briefing – Anonymous, secure, open source WebRTC group video chat

#20

Post by inanutshellus »

perenzo wrote: post #19
walterbell wrote: post #18

Earlier quoted context omitted.

How about the term "unauthenticated", which is well understood for HTTP requests?

Well, IMO the definition of the word "anonymous" still fits how personal information is handled in Briefing: "Anonymity describes situations where the acting person's name is unknown" [1] And this is true regarding the Briefing service. [1] https://en.wikipedia.org/wiki/Anonymity

Heh, well you cherry-picked there. It goes on to say ". The important idea here is that a person be non-identifiable, unreachable, or untrackable."

Regardless, it's Wikipedia, that definition ought to be fixed to say "identity" rather than "name".

Post reply on HN