Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

git.jami.net

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#31

Post by lilSebastian »

squarefoot wrote: post #26

I just installed on a Debian 10 machine, then on my old Android 6.0.1 junk tablet. No problems on the PC, while the Android one always crashes when attempting to pair with the PC by pointing the camera at the QR code, and adding manually the exported account on the network hangs indefinitely on the "adding account" window. Not a big issue since I don't carry the tablet around, just to let the developers know if they…

> just to let the developers know if they read here.

Or, raise the issue with them for investigation, since a comment on an unrelated site isn't a reasonable way to provide feedback

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#32

Post by dependenttypes »

CiPHPerCoder wrote: post #28

> end-to-end encrypted O RLY? https://git.jami.net/savoirfairelinux/ring-client-android/is... https://security.stackexchange.com/a/171461/43688 I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it. Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack. https://git.jami.net/savo…

> > The SHA-1 fingerprint (160-bits) of this public certificate is the JamiId.

I do not see any issue with this.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#33

Post by tptacek »

CiPHPerCoder wrote: post #28

> end-to-end encrypted O RLY? https://git.jami.net/savoirfairelinux/ring-client-android/is... https://security.stackexchange.com/a/171461/43688 I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it. Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack. https://git.jami.net/savo…

The code you were looking for is in the OpenDHT project, which simply calls GnuTLS's gnutls_pubkey_encrypt_data(), which is PKCS1v15. OpenDHT doesn't do anything special with errors from decryption. You'd have to actually set up a test environment to say it was vulnerable with any confidence, though.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#34

Post by CiPHPerCoder »

tptacek wrote: post #33
CiPHPerCoder wrote: post #28

> end-to-end encrypted O RLY? https://git.jami.net/savoirfairelinux/ring-client-android/is... https://security.stackexchange.com/a/171461/43688 I looked through their code to see where data is being encrypted/decrypted, and was unable to locate it. Since their issue indicated they use 4096-bit RSA, I really wanted to see if they were vulnerable to Bleichenbacher's 1998 padding oracle attack. https://git.jami.net/savo…

The code you were looking for is in the OpenDHT project, which simply calls GnuTLS's gnutls_pubkey_encrypt_data(), which is PKCS1v15. OpenDHT doesn't do anything special with errors from decryption. You'd have to actually set up a test environment to say it was vulnerable with any confidence, though.

Thanks Thomas!

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#35

Post by Freak_NL »

surround wrote: post #6

In comparison to Zoom and Jitsi: Jami’s major advantages are that it’s end-to-end encrypted and completely peer-to-peer, requiring no server in-between. The major disadvantage is that it doesn’t support calls from the browser. See also: https://jami.net

Not running in the browser is a major downside. I've used Jitsi this past week with technologically illiterate family members, and being able to just have them enter a URL while talking on the phone is really great.

Also, being able to just use any OS with a modern browser you please.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#36

Post by systemvoltage »

jachee wrote: post #27
systemvoltage wrote: post #19

Earlier quoted context omitted.

Why does a product name have to have a "meaning" behind it? Kodachrome was abstract.

Kodachrome wasn't abstract. It was Kodak's color film, and thus a pseudo-portmanteau of "Kodak" and "chroma" (i.e. color). I'm sure there are meanings behind a lot of the other names you listed, too.

How about Kodak? I am sure there are many names that are abstract.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#37

Post by tincholio »

divbzero wrote: post #24
beanjammin wrote: post #3

Interesting, I haven't tried Jami. If I am understanding it correctly it seems to provide calling features, which Zoom and other typical video conferencing type applications don't. I'll also through Jitsi out there as a very capable FLOSS alternative to Zoom. If you tried it a few years ago it's changed dramatically in the last while. It's now WebRTC based and runs in browser without any download. It's not quite end…

Can’t WebRTC support peer-to-peer video calls without running the stream through a server? I have vague recollection that it can but am not particularly familiar with the protocol.

It does, but when the number of users is >2, typically you will go through a TURN server.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#39

Post by anilakar »

craftinator wrote: post #22
systemvoltage wrote: post #19

Earlier quoted context omitted.

Why does a product name have to have a "meaning" behind it? Kodachrome was abstract.

It doesn't have to. But it can. This is an example of that.

The shorter your name is, the easier it is to find unintended connotations or outright obscene meanings in different languages – and now because your product is global, you just can't localize its name for foreign markets like Mitsubishi had to do with Pajero in Spain.

Re: Jami: GNU end-to-end encrypted alternative to Zoom and Jitsi

#40

Post by pmontra »

systemvoltage wrote: post #36
jachee wrote: post #27

Earlier quoted context omitted.

Kodachrome wasn't abstract. It was Kodak's color film, and thus a pseudo-portmanteau of "Kodak" and "chroma" (i.e. color). I'm sure there are meanings behind a lot of the other names you listed, too.

How about Kodak? I am sure there are many names that are abstract.

From https://petapixel.com/2011/08/03/origin-and-evolution-of-kod...

> The letter “K” had been a favorite of Eastman’s, he is quoted as saying, “it seems a strong, incisive sort of letter.” He and his mother devised the name Kodak with an anagram set. He said that there were three principal concepts he used in creating the name: it should be short, one cannot mispronounce it, and it could not resemble anything or be associated with anything but Kodak

Post reply on HN