Live data from Hacker News

Jitsi Meet Security and Privacy

jitsi.org

21–30 of 31 posts

Re: Jitsi Meet Security and Privacy

#21
post #2

Short answer: like Zoom, multiparty Jitsi meetings are encrypted point-to-point, not end-to-end, and Jitsi can monitor and record your multiparty meetings.

... unless you self-host the server. What you can do with jitsi, but not with zoom.

You can self-host zoom: https://support.zoom.us/hc/en-us/articles/201363093-Deployin...

Re: Jitsi Meet Security and Privacy

#22
post #17

If you are using webrtc in the browser e2e is not possible. Which is why it’s critical you have the ability to self host such solutions.

What are you talking about? Webrtc has mandatory encryption. The only issue is using a simulcast middleware server. If you’re doing mesh p2p then it’s e2e.

Re: Jitsi Meet Security and Privacy

#23

> Take the case of 10 people having a discussion in a room. You wouldn’t expect one person to have exclusive "kick" and "mute" privileges in an in-person meeting and yet, those meetings usually go fine. > In the vast majority of cases, moderation controls in online meetings serve a different purpose: they help address tech related issues, such as people not realizing their microphones are introducing noise, or people…

Ok, but if posting to HN, please don't just rant about how stupid other people are. If you know more than others, share some of what you know, so the rest of us can learn something. And please omit name-calling.

"A good critical comment teaches us something."

https://news.ycombinator.com/newsguidelines.html

Re: Jitsi Meet Security and Privacy

#24
post #16
post #8

Earlier quoted context omitted.

I have done so on the smallest cheapest gcloud instance and it worked alright. Under a cent an hour for privacy seems worth it.

Don't forget to include bandwidth costs, which turn out to be much higher than you'd expect. 1.5 hours of with 6 participants using simulcast corresponds to about 20GB of outbound (inbound is free on AWS). Which corresponds to a little under $2 (at $0.09 per GB).

I thought jitsi sent video from user to user, not via server? Or is that a configuration matter?

Re: Jitsi Meet Security and Privacy

#25
post #16

Earlier quoted context omitted.

Don't forget to include bandwidth costs, which turn out to be much higher than you'd expect. 1.5 hours of with 6 participants using simulcast corresponds to about 20GB of outbound (inbound is free on AWS). Which corresponds to a little under $2 (at $0.09 per GB).

I thought jitsi sent video from user to user, not via server? Or is that a configuration matter?

It only does p2p if there's exactly two participants, otherwise it goes through the server.

Re: Jitsi Meet Security and Privacy

#26
post #11

Are there any cryptographic and/or network designs which allow end-to-end encryption of a group video chat without full meshing?

The point is not the crypto, but what WebRTC supports. As of now it does not. See https://webrtchacks.com/you-dont-have-end-to-end-encryption-... for reference

Re: Jitsi Meet Security and Privacy

#27
post #17

If you are using webrtc in the browser e2e is not possible. Which is why it’s critical you have the ability to self host such solutions.

What are you talking about? Webrtc has mandatory encryption. The only issue is using a simulcast middleware server. If you’re doing mesh p2p then it’s e2e.

Obviously - I was referring to when you have a SFU, such as Jitsi and comparable to zoom.

The concept of e2e encryption doesn’t even make sense in p2p, the fact that direct communication between two peers is “end to end encrypted” is self evident. It’s only when there is a central server that talking about e2e as a concept is relevant.

Re: Jitsi Meet Security and Privacy

#28
post #26
post #11

Are there any cryptographic and/or network designs which allow end-to-end encryption of a group video chat without full meshing?

The point is not the crypto, but what WebRTC supports. As of now it does not. See https://webrtchacks.com/you-dont-have-end-to-end-encryption-... for reference

Of course WebRTC is only a requirement if you want to be browser-based. And even then, some solutions use WebRTC data channels for video instead (e.g. Zoom's web version). They could do it, although you'd of course still be trusting the server to serve you the right thing.
Post reply on HN