Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jitsi privacy flaw enables one-click stealth audio and video capture

zimzi.substack.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#31

Post by dathinab »

dathinab wrote: post #20
Telemakhos wrote: post #8

Maybe my Mac is set to be paranoid, but can you share video without being asked to give the mic and camera permission to operate? I chat with jitsi all the time and have to give jitsi explicit permission to use the mic/camera each time.

> but can you share video without being asked to give the mic and camera permission to operate? yes it's a browser setting to "remember mic/camera permission for given site" to which extend this "remember" is there by default, can be disabled through system config/MDA etc. is probably very lastly iff that is a default for Safari on Mac I wouldn't be surprised if that was not only placed their to protect your safety b…

> is probably very [????]

... browser specific

not sure where that words disappeared, too

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#33

Post by iforgotpassword »

I mean, I get the idea that you want to skip the whole configure step for webcam/mic if it's embedded somewhere, but I still expect cam/mic to be muted on join. Isn't that what most conferencing tools do, no matter whether you get a config dialog after clicking the join link...

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#34

Post by johnisgood »

victorbjorklund wrote: post #16
Telemakhos wrote: post #8

Maybe my Mac is set to be paranoid, but can you share video without being asked to give the mic and camera permission to operate? I chat with jitsi all the time and have to give jitsi explicit permission to use the mic/camera each time.

Probably 99% of people clicks "yes, always"

I click and tap "Only this time" on Android and in browsers.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#35

Post by saghul »

qualeed wrote: post #29
saghul wrote: post #28

Jitsi dev here. We are currently revisiting this. It exists because in cases such as when Jitsi Meet is being embdeed there are pre-join pages provided externally by the "host" site. We will be limiting how this can be used going forward.

Is/will there be any discussion on how initial triage of potential security issues will be handled in the future? It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish. Jitsi says " We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space. ". But if no…

You are right, we dropped the ball on this one. We'll try and do better.

Re: Jitsi privacy flaw enables one-click stealth audio and video capture

#36

Post by arm32 »

saghul wrote: post #35
qualeed wrote: post #29

Earlier quoted context omitted.

Is/will there be any discussion on how initial triage of potential security issues will be handled in the future? It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish. Jitsi says " We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space. ". But if no…

You are right, we dropped the ball on this one. We'll try and do better.

Instead of trying, just do. Just do better.
Post reply on HN