12 ms·

Does your video call have End-to-End Encryption? Probably not

217 points by supermatt 7y ago

notRobot 7y ago
WhatsApp claims that its calls are end-to-end encrypted: https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ As does Riot.im (I think? Can't find any explicit mention of calls being encrypted): https://about.riot.im/features.html https://about.riot.im/features.html Can someone with more expertise comment on these two? (I understand that because WhatsApp isn't F/LOSS, there's a lot that we can't know about how it works).
- fwn 7y ago
  I'm using Google Duo a lot and (to my surprise) it claims to be end-to-end encrypted: https://support.google.com/duo/answer/9280240?hl=en https://support.google.com/duo/answer/9280240?hl=en I started to use it as an alternative to WhatsApp calls for their superior call quality. Many people already have it without knowing about it. AFAIK that's due to being preinstalled on newer devices or being available as an instant app(?) That does seem to imply that you don't have to actively install it to work? ... but I'm not sure.
- amiraliakbari 7y ago
  Riot (Matrix to be precise) only supports E2E encryption for one to one calls. Group calls are handled by a Jitsi backend and are unavailable in E2E encrypted conversations with more than two members.
- kelnage 7y ago
  My understanding of how these E2E products often do their (video) call encryption is not that they use a clever communication protocol like the one used in Signal to protect each frame/packet (which would likely introduce huge amounts of delay - not a good user experience!). Instead during call initiation, they do the key negotiation/sharing over the same messaging protocol they use to transmit their normal messages; i.e. effectively they generate the call encryption key on the device, send it as a E2E encrypted message to the call recipient(s), and use the standard call encryption methods (probably based on SRTP?) to actually protect the call. Thus, assuming the call encryption methods work correctly (which I have no immediate reason to believe they don't), for an adversary to obtain the key (and decrypt the call), they would need to break the E2E encryption used to transmit the messages; therefore the call is E2E encrypted.
- jillesvangurp 7y ago
  It's very simple, the vast majority of popular chat applications out there don't have open source backends. Which means we basically have to trust their owners to do the right things and hope for the best. The business model of choice in this space is to (sometimes) have partially open source clients but almost never use OSS in the backend. There's a lot of secret sauce and magic that these companies use to differentiate from each other and most of that is proprietary. This provides these companies with a control point to lock in their users to their network. For the same reason attempts at standardization of protocols and federating chats and calls between networks have largely stalled/failed. XMPP is technically still around; it's just that none of the popular solutions in this space use it. I'd say Signal is the positive exception in this space where both server and client are OSS and the client UX is pretty decent. Telegram talks a lot about security as well but their OSS seems limited to mostly client side. Of course a lot of the crypto is client side so depending on how paranoid you are that may or may not be good enough. Either way there probably is a lot of server side stuff that is relevant to end to end security that is not being scrutinized outside Telegram. For both, even if the client is OSS, what goes into the app stores may still include stuff not accounted for in the source code. Auditing the source code and the binaries are two things. And then there's the runtime environment to consider, which is a OS that is probably proprietary that includes lots of stuff that is a bit icky from a security point of view. So, there's multiple levels of "trust us, we know what we are doing" that you'd have to buy into in order to feel secure. IMHO that has been a problem for a while but most people/companies seem to be indifferent when it comes to security and happily pay through their nose for 100% proprietary security snake oil peddled by the sales people of e.g. MS, Zoom, Slack, etc.
  - Aachen 7y ago
    > the vast majority of popular chat applications out there don't have open source backends. Which means we basically have to trust their owners to do the right things and hope for the best. Err, if that were the case, then why do we bother with encryption at all? End to end encryption means you don't need to trust the owners, at least for message contents. For metadata, yeah, that's why I choose not to use a known-bad company like Facebook (i.e. WhatsApp) and would rather use Signal or Wire and hope for the best, but that's only metadata. Doesn't mean I trust Wire with the contents of my communication, at least when verifying people's keys.
- hiq 7y ago
  WhatsApp calls are limited to 4 parties or so, which is a deal-breaker for a lot of people.
  - Aachen 7y ago
    Wire's video calls are also limited to 4 people. I think it's a client-side limit, but with 4 our laptops/phones already struggle so it seems to be a sensible limit. Audio calls can be with more people, at least six but I don't know how many. I guess such are the limitations of encryption currently, at least when one wants to have browser support instead of native code and wants to support mobile systems.
- ezg 7y ago
  WhatsApp is owned by a company in the business of collecting metadata so I don't trust them as far as I can throw them. Even if the call is E2E, your address book is uploaded directly to their server.
woile 7y ago
What about jitsi[1]? I've started to see it pop up in different places. Has anyone tried it? [1]: https://meet.jit.si/ https://meet.jit.si/
- messo 7y ago
  I have used Jitsi a couple of times but it has been a bit buggy. Not sure if that is because I used the meet.jit.si-server instead of setting up my own, it might be under heavy load. I have had more success with Nextcloud Talk[0], which we have started testing on the internal network in my company. It even has decent mobile apps and webinar functionality. It's also a bit easier on the CPU compared to Jitsi. [0] https://nextcloud.com/talk/ https://nextcloud.com/talk/
- cyphar 7y ago
  Jitsi Meet works pretty well (though I agent used it for really big meetings). But in the context of this article, it suffers from the same issues it outlines because it's based on WebRTC.
- Aachen 7y ago
  I've tried setting Jitsi up and didn't find it was very easy (though I also didn't spend that much time on it), but I used it a few times with a friend's setup and as a client it worked alright.
logjammin 7y ago
I've been using Wire [1] for years on desktop in large part because of their E2E claims; I wanted something simple and secure that worked relatively fluidly for video calls. I've had mostly pleasant experiences with it, and with many calls I'm surprised by the video quality. I've never tried their mobile app, but they've got one and it looks nice, aesthetically. Main drawback has really been that few people I know use it and I've had to cajole people into doing so a little bit, which stinks. But I'm not a cryptographer and am unable to verify the company's security claims. For all I know it's go zero encryption whatsoever. Are there people on HN who feel qualified to comment? Has anyone used Wire before? [1] https://wire.com/en/ https://wire.com/en/
- tribby 7y ago
  the audio on wire is great, too. I agree adoption has been slow. > But I'm not a cryptographer and am unable to verify the company's security claims. wire has been independently audited (protocol and application): https://medium.com/@wireapp/wire-application-level-security-audits-98324d1f211b https://medium.com/@wireapp/wire-application-level-security-...
- wyattpeak 7y ago
  > Main drawback has really been that few people I know use it and I've had to cajole people into doing so a little bit, which stinks. I find it fascinating how committed everyone now is to Zoom when, at least in my circle, almost nobody had used it before two weeks ago. At that point, everyone installed it as soon as the first meeting came up, and besides the ten minutes of everyone figuring it out it was plain sailing. It's incredible to me that something everyone did without a thought two weeks ago (installing a new chat application) is now enough of a burden to not bother with. Highlights strikingly the value of being the first mover (or first adopted, as the case may be).
  - hiq 7y ago
    You can use Zoom with a browser though, which means you might not have to install anything. In practice it has never worked for me in the browser (on Debian), but I guess it does for most people.
supermatt 7y ago
TLDR: WebRTC supports e2e encryption between peers. full mesh p2p videoconferencing is very inefficient for large conferences so an SFU (Selective Forwarding Unit) is used - a server acting as a peer that redistributes the streams to call parties. This SFU is basically a middleman - it decrypts the stream, and reincrypts it as it forwards - meaning that there is no e2e encryption. This is a current limitation of webrtc mediastreams. There is discussion underway to fix this with "Insertable Streams", allowing you to transform streams (e.g. insert an additional encryption layer). MY THOUGHTS: Zoom already bypass the usual webrtc mediastreams - instead they use wasm ffmpeg to record from a canvas and send that data over a data-channel to their SFU. It seems to me that they could instead encrypt this data before sending it over the stream, and distribute keys directly between peers via a full mesh - this would give them full e2e. As an aside, the ability to implement something like this is SEVERELY hampered by apples decision not to support webm. I simply do not understand why they refuse to do so. If they supported webm (and the MediaRecorder API) then there would be no need to perform unaccelerated wasm-based patent-encumbered video encoding in the browser in order to provide e2e encrypted media streams via sfu. DISCLAIMER: I don't work for zoom, but I do work on a product that handles e2e webrtc via SFU using similar mechanisms to that I explained above.
- aloer 7y ago
  What does record from a canvas mean in this context? Is that html canvas? If so, how are they filling it with local screen content?
  - supermatt 7y ago
    HTML canvas, yes. They use a webgl context (but you can also do similar with a 2d context) containing a video texture (from the mediastream - video/webcam/screencap/etc). You can find a number of examples by searching "getUserMedia" and "canvas" - for example: https://webrtc.github.io/samples/src/content/getusermedia/canvas/ https://webrtc.github.io/samples/src/content/getusermedia/ca... edit: apologies, here they read the pixel data from the video element, but the principle is the same. One reason for using a canvas intermediary (or even multiple) is to provide multiple sizes, or perform some processing, such as background removal, for example.
Arathorn 7y ago
fwiw 1:1 calls in Matrix are e2e encrypted if you do them in an encrypted DM. for conferences, they can be e2ee too if you do them full mesh (like wire), but for scalability we use jitsi currently in Riot. Meanwhile, https://github.com/matrix-org/matrix-doc/pull/2359 https://github.com/matrix-org/matrix-doc/pull/2359 is worth a read.
- kitotik 7y ago
  Perhaps you could blog or tweet about this to draw some more attention to it? Clearly there is an appetite for this, and it could get some more people involved with matrix.
mproud 7y ago
Maybe not many people get to use it for work, but FaceTime video calls are.
- deadmutex 7y ago
  IIUC, as does Duo :), with the benefit that you can reach both Android and iOS users. Disclaimer: Work at Google, but views are my own.
  - mmwelt 7y ago
    I would very much like to use Duo, but that's not available in China. Whereas Facetime works very well in and out of China.
  - supermatt 7y ago
    AFAIK Duo doesn't support e2e encrypted multiparty conferences in the browser. Its only if all parties are using the mobile apps.
    - fwn 7y ago
      Do you have some kind of source for that? I'd love to read more about it!
    - deadmutex 7y ago
      I didn't see an exception for the browser calls being called out here: https://support.google.com/duo/answer/9280240?hl=en https://support.google.com/duo/answer/9280240?hl=en, so I am guessing it does support e2e encryption.
      - supermatt 7y ago
        You can guess whatever you like - but Duo doesn't even support multiparty conferences in the browser...
        7y ago
BiteCode_dev 7y ago
Phone calls, emails, and text messages don't have e2e encryption, and we have been using them for 40 years. We are still using them. Nobody cares. The USA communications are under constant mass surveillance, by a group of people that denies it, abuses it, uses secret courts to rule about it even when unconstitutional, coerce others to submit every data and shut up about it, and destroy the life of whoever point finger at it. And people still don't care. Good luck with telling people that are recording their entire life on facebook, snapchat and tik tok to be mindful about the tools they use.
- kristopolous 7y ago
  Is it necessarily a problem? I've actually been bitten more by things that were encrypted without telling me when I went to try to restore things or do some kind of archiving. Encryption should be explicit and available, but optional in the same way I could leave my front door unlocked. The forcing of either direction is the real problem
  - Legogris 7y ago
    It seems you are conflating transport encryption with encryption at rest. I can not imagine a scenario where encrypted end-to-end transit can "bite" you as there is no recovery scenario apart from snooping network operators/attackers.
    - eukgoekoko 7y ago
      E2E encryption can be really resource consuming, especially with the amount of traffic used for video chat. You might not want this just because of a worse user experience.
      - zrm 7y ago
        Video chat is something like 1.5Mbps. Even phones can do chacha20 at >1000Mbps these days. It's not that expensive. Where people start to feel it is if you want the server in the middle to be decrypting and re-encrypting everything, because it's not that much for one user but it starts to add up for a million users. But the obvious solution there is to use E2EE and then it isn't doing that.
mrfusion 7y ago
Is https considered end to end encryption? Why or why not?
- prophesi 7y ago
  HTTPS is point-to-point encryption. It's good for client <-> server communication. If you need to send data to another client through the server, then HTTPS won't suffice. The server decrypts the data and then sends it to the other client via HTTPS. So if there's more than two points (client <-> server <-> client) you'll need end-to-end encryption.
  - mrfusion 7y ago
    Good point. So how would something like HN work with end to end encryption? I guess users see each other’s posts but the server can’t.
    - prophesi 7y ago
      Yeah, that'd be pretty tricky. End-to-end encryption is really easy to implement if you're sending data to only one user. It gets really hard and really slow once you start adding more users. A simple way would be to encrypt your message with a symmetric key. Then encrypt this symmetric key with your private key, and create a copies of it for each recipient and encrypting it with their public key. So each recipient can decrypt the symmetric key and use that to decrypt the message. You can probably guess that this gets really messy as you start adding more users. And you need to know the difference between symmetric key encryption and public key encryption. It's probably better to look at a peer-to-peer solution, or find a more efficient protocol. This is a pretty enlightening StackOverflow post on the subject: https://security.stackexchange.com/questions/126768/which-protocols-exist-for-end-to-end-encrypted-group-chat/127331#127331 https://security.stackexchange.com/questions/126768/which-pr...
      - snarf21 7y ago
        Most public/private use symmetric encryption for the data anyway but they use a key derivation scheme to share the key. You can't use public/private encryption for data size greater than the key size. Obviously you can sign/verify any data size. Also, above you said "encrypt this symmetric key with your private key", did you mean sign this symmetric key?
est 7y ago
Does e2e work with a large group of people video conferencing? I thought encryption might get pretty expensive if 1080p streaming directly between peers. For a team of 30 people it eats bandwidth quickly. If there's some kind of server (or supernode) transcoding, does transcoding work with e2e?
- supermatt 7y ago
  Yes, you can have e2e encryption videoconferencing with large groups of people - just not using webrtc (unless you do some crazy hacks - mentioned in my other comment). By definition, a transcoding server or supernode (acting as an MCU - Multipoint Conferencing Unit) would be a MITM, so that wouldnt be e2e encrypted. A simple way with WebRTC for a small conference, would be to transcode on the origin and provide multiple streams to peers - one for thumbnails, one for higher quality, low bandwidth fallbacks, etc. This doesnt scale well, but it works nicely for small conferences.
ghgr 7y ago
At my company we use a self-hosted Nextcloud instance with the Talk plug-in. It has chat, video, audio and screen-sharing. It may not be E2E encrypted, but the data never leaves our servers. It also makes a better impression when you share a <own_company>.eu link instead of a .webex.com or .zoom.us link.
- kreetx 7y ago
  The Sextcloud homepage says it has "encrypted, peer-to-peer audio/video calls", so it probably is end-to-end encrypted, at least for two-people calls. Conference calls probably not, since they say "Individual and group calls & chat" (i.e not mentioning encryption).
josteink 7y ago
Does the average person care? Probably not.
ezg 7y ago
I'm with Silent Circle all the way. Love their video and conference calling features and it's encryption I completely trust.
- Erlich_Bachman 7y ago
  Why do you completely trust it?
  - ezg 7y ago
    I'll be upfront, I'm a little biased... my dad wrote ZRTP and helped design the encryption on the Silent Phone app. There are a number of reasons I trust it. One is that the user is involved in authenticating the call. Most other encryption apps bury that authentication in the settings, allowing you to not worry your pretty little head about it. I trust both the good intentions behind the design as well as the implementation.
    - Erlich_Bachman 7y ago
      But if it's not open source...?
      - dexterdog 7y ago
        Does Phil Zimmerman still work for them?
- ezg 7y ago
  https://www.silentcircle.com/ https://www.silentcircle.com/
d0100 7y ago
I could quite understand what he meant about WebRTC, is it encripted, but not super encripted, or is it such a junky encription that a script-kiddy can decrypt it? Just launched a product that uses WebRTC and we have a marketing blurb that says that our P2P WebRTC is encrypted. Is that wrong? Twilio says it is
- supermatt 7y ago
  It is encrypted, yes. The discussion is over end-to-end encryption - i.e. is there a middle server that has access to the unencrypted streams, or do peers communicate directly with each other. This depends on your implementation.
EvgeniyZh 7y ago
Let's switch to Tox
hprotagonist 7y ago
my understanding is that group FaceTime calls really are E2E. i don’t know about skype, and i don’t think Signal even supports it.
101404 7y ago
Should I care? My conversations in a Café don't have e2e either.
hypewatch 7y ago
> Does your video call have end-to-end encryption? Probably not. This headline is inaccurate. FaceTime has end-to-end encryption and is one of the most popular video call apps used for personal calls. https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/
- cgh 7y ago
  A lot of people here probably won't believe this, but Cisco Webex offers end to end encryption, but not by default. If you use it, you lose a bunch of features. But it is available, and Webex is immensely popular in the corporate world. https://help.webex.com/en-us/WBX44739/What-Does-End-to-End-Encryption-Do https://help.webex.com/en-us/WBX44739/What-Does-End-to-End-E...
- bryanmgreen 7y ago
  Not an Apple die-hard (have never owned one of their computers) but their privacy efforts are, for me, increasingly a reason to either own or use their products. I think privacy will be the backbone of Tim Cook's legacy.
marknadal 7y ago
This was a really informative article, thank you. For anybody that is interested in an Open Source example of the "mesh" that is E2EE that the article mentions (tho not scalable, without switching to SFU & doing what they say), you can check out this repo ( https://github.com/meething/webrtc-gun https://github.com/meething/webrtc-gun ) that our community built in a couple of days. https://mozilla.org/builders https://mozilla.org/builders is an 8 week paid hackathon Mozilla is sponsoring, and teams are forming there, thinking about building a better Open Source E2EE multi-party Zoom alternative.

217 points by supermatt 7y ago

WhatsApp claims that its calls are end-to-end encrypted: https://faq.whatsapp.com/en/android/28030015/ https://faq.whatsapp.com/en/android/28030015/ As does Riot.im (I think? Can't find any explicit mention of calls being encrypted): https://about.riot.im/features.html https://about.riot.im/features.html Can someone with more expertise comment on these two? (I understand that because WhatsApp isn't F/LOSS, there's a lot that we can't know about how it works).

fwn 7y ago
I'm using Google Duo a lot and (to my surprise) it claims to be end-to-end encrypted: https://support.google.com/duo/answer/9280240?hl=en https://support.google.com/duo/answer/9280240?hl=en I started to use it as an alternative to WhatsApp calls for their superior call quality. Many people already have it without knowing about it. AFAIK that's due to being preinstalled on newer devices or being available as an instant app(?) That does seem to imply that you don't have to actively install it to work? ... but I'm not sure.
amiraliakbari 7y ago
Riot (Matrix to be precise) only supports E2E encryption for one to one calls. Group calls are handled by a Jitsi backend and are unavailable in E2E encrypted conversations with more than two members.
kelnage 7y ago
My understanding of how these E2E products often do their (video) call encryption is not that they use a clever communication protocol like the one used in Signal to protect each frame/packet (which would likely introduce huge amounts of delay - not a good user experience!). Instead during call initiation, they do the key negotiation/sharing over the same messaging protocol they use to transmit their normal messages; i.e. effectively they generate the call encryption key on the device, send it as a E2E encrypted message to the call recipient(s), and use the standard call encryption methods (probably based on SRTP?) to actually protect the call. Thus, assuming the call encryption methods work correctly (which I have no immediate reason to believe they don't), for an adversary to obtain the key (and decrypt the call), they would need to break the E2E encryption used to transmit the messages; therefore the call is E2E encrypted.
jillesvangurp 7y ago
It's very simple, the vast majority of popular chat applications out there don't have open source backends. Which means we basically have to trust their owners to do the right things and hope for the best. The business model of choice in this space is to (sometimes) have partially open source clients but almost never use OSS in the backend. There's a lot of secret sauce and magic that these companies use to differentiate from each other and most of that is proprietary. This provides these companies with a control point to lock in their users to their network. For the same reason attempts at standardization of protocols and federating chats and calls between networks have largely stalled/failed. XMPP is technically still around; it's just that none of the popular solutions in this space use it. I'd say Signal is the positive exception in this space where both server and client are OSS and the client UX is pretty decent. Telegram talks a lot about security as well but their OSS seems limited to mostly client side. Of course a lot of the crypto is client side so depending on how paranoid you are that may or may not be good enough. Either way there probably is a lot of server side stuff that is relevant to end to end security that is not being scrutinized outside Telegram. For both, even if the client is OSS, what goes into the app stores may still include stuff not accounted for in the source code. Auditing the source code and the binaries are two things. And then there's the runtime environment to consider, which is a OS that is probably proprietary that includes lots of stuff that is a bit icky from a security point of view. So, there's multiple levels of "trust us, we know what we are doing" that you'd have to buy into in order to feel secure. IMHO that has been a problem for a while but most people/companies seem to be indifferent when it comes to security and happily pay through their nose for 100% proprietary security snake oil peddled by the sales people of e.g. MS, Zoom, Slack, etc.
- Aachen 7y ago
  > the vast majority of popular chat applications out there don't have open source backends. Which means we basically have to trust their owners to do the right things and hope for the best. Err, if that were the case, then why do we bother with encryption at all? End to end encryption means you don't need to trust the owners, at least for message contents. For metadata, yeah, that's why I choose not to use a known-bad company like Facebook (i.e. WhatsApp) and would rather use Signal or Wire and hope for the best, but that's only metadata. Doesn't mean I trust Wire with the contents of my communication, at least when verifying people's keys.
hiq 7y ago
WhatsApp calls are limited to 4 parties or so, which is a deal-breaker for a lot of people.
- Aachen 7y ago
  Wire's video calls are also limited to 4 people. I think it's a client-side limit, but with 4 our laptops/phones already struggle so it seems to be a sensible limit. Audio calls can be with more people, at least six but I don't know how many. I guess such are the limitations of encryption currently, at least when one wants to have browser support instead of native code and wants to support mobile systems.
ezg 7y ago
WhatsApp is owned by a company in the business of collecting metadata so I don't trust them as far as I can throw them. Even if the call is E2E, your address book is uploaded directly to their server.

woile 7y ago

What about jitsi[1]? I've started to see it pop up in different places. Has anyone tried it? [1]: https://meet.jit.si/ https://meet.jit.si/

messo 7y ago
I have used Jitsi a couple of times but it has been a bit buggy. Not sure if that is because I used the meet.jit.si-server instead of setting up my own, it might be under heavy load. I have had more success with Nextcloud Talk[0], which we have started testing on the internal network in my company. It even has decent mobile apps and webinar functionality. It's also a bit easier on the CPU compared to Jitsi. [0] https://nextcloud.com/talk/ https://nextcloud.com/talk/
cyphar 7y ago
Jitsi Meet works pretty well (though I agent used it for really big meetings). But in the context of this article, it suffers from the same issues it outlines because it's based on WebRTC.
Aachen 7y ago
I've tried setting Jitsi up and didn't find it was very easy (though I also didn't spend that much time on it), but I used it a few times with a friend's setup and as a client it worked alright.

logjammin 7y ago

I've been using Wire [1] for years on desktop in large part because of their E2E claims; I wanted something simple and secure that worked relatively fluidly for video calls. I've had mostly pleasant experiences with it, and with many calls I'm surprised by the video quality. I've never tried their mobile app, but they've got one and it looks nice, aesthetically. Main drawback has really been that few people I know use it and I've had to cajole people into doing so a little bit, which stinks. But I'm not a cryptographer and am unable to verify the company's security claims. For all I know it's go zero encryption whatsoever. Are there people on HN who feel qualified to comment? Has anyone used Wire before? [1] https://wire.com/en/ https://wire.com/en/

tribby 7y ago
the audio on wire is great, too. I agree adoption has been slow. > But I'm not a cryptographer and am unable to verify the company's security claims. wire has been independently audited (protocol and application): https://medium.com/@wireapp/wire-application-level-security-audits-98324d1f211b https://medium.com/@wireapp/wire-application-level-security-...
wyattpeak 7y ago
> Main drawback has really been that few people I know use it and I've had to cajole people into doing so a little bit, which stinks. I find it fascinating how committed everyone now is to Zoom when, at least in my circle, almost nobody had used it before two weeks ago. At that point, everyone installed it as soon as the first meeting came up, and besides the ten minutes of everyone figuring it out it was plain sailing. It's incredible to me that something everyone did without a thought two weeks ago (installing a new chat application) is now enough of a burden to not bother with. Highlights strikingly the value of being the first mover (or first adopted, as the case may be).
- hiq 7y ago
  You can use Zoom with a browser though, which means you might not have to install anything. In practice it has never worked for me in the browser (on Debian), but I guess it does for most people.

supermatt 7y ago

TLDR: WebRTC supports e2e encryption between peers. full mesh p2p videoconferencing is very inefficient for large conferences so an SFU (Selective Forwarding Unit) is used - a server acting as a peer that redistributes the streams to call parties. This SFU is basically a middleman - it decrypts the stream, and reincrypts it as it forwards - meaning that there is no e2e encryption. This is a current limitation of webrtc mediastreams. There is discussion underway to fix this with "Insertable Streams", allowing you to transform streams (e.g. insert an additional encryption layer). MY THOUGHTS: Zoom already bypass the usual webrtc mediastreams - instead they use wasm ffmpeg to record from a canvas and send that data over a data-channel to their SFU. It seems to me that they could instead encrypt this data before sending it over the stream, and distribute keys directly between peers via a full mesh - this would give them full e2e. As an aside, the ability to implement something like this is SEVERELY hampered by apples decision not to support webm. I simply do not understand why they refuse to do so. If they supported webm (and the MediaRecorder API) then there would be no need to perform unaccelerated wasm-based patent-encumbered video encoding in the browser in order to provide e2e encrypted media streams via sfu. DISCLAIMER: I don't work for zoom, but I do work on a product that handles e2e webrtc via SFU using similar mechanisms to that I explained above.

aloer 7y ago
What does record from a canvas mean in this context? Is that html canvas? If so, how are they filling it with local screen content?
- supermatt 7y ago
  HTML canvas, yes. They use a webgl context (but you can also do similar with a 2d context) containing a video texture (from the mediastream - video/webcam/screencap/etc). You can find a number of examples by searching "getUserMedia" and "canvas" - for example: https://webrtc.github.io/samples/src/content/getusermedia/canvas/ https://webrtc.github.io/samples/src/content/getusermedia/ca... edit: apologies, here they read the pixel data from the video element, but the principle is the same. One reason for using a canvas intermediary (or even multiple) is to provide multiple sizes, or perform some processing, such as background removal, for example.

Arathorn 7y ago

fwiw 1:1 calls in Matrix are e2e encrypted if you do them in an encrypted DM. for conferences, they can be e2ee too if you do them full mesh (like wire), but for scalability we use jitsi currently in Riot. Meanwhile, https://github.com/matrix-org/matrix-doc/pull/2359 https://github.com/matrix-org/matrix-doc/pull/2359 is worth a read.

kitotik 7y ago
Perhaps you could blog or tweet about this to draw some more attention to it? Clearly there is an appetite for this, and it could get some more people involved with matrix.

mproud 7y ago

Maybe not many people get to use it for work, but FaceTime video calls are.

deadmutex 7y ago
IIUC, as does Duo :), with the benefit that you can reach both Android and iOS users. Disclaimer: Work at Google, but views are my own.
- mmwelt 7y ago
  I would very much like to use Duo, but that's not available in China. Whereas Facetime works very well in and out of China.
- supermatt 7y ago
  AFAIK Duo doesn't support e2e encrypted multiparty conferences in the browser. Its only if all parties are using the mobile apps.
  - fwn 7y ago
    Do you have some kind of source for that? I'd love to read more about it!
  - deadmutex 7y ago
    I didn't see an exception for the browser calls being called out here: https://support.google.com/duo/answer/9280240?hl=en https://support.google.com/duo/answer/9280240?hl=en, so I am guessing it does support e2e encryption.
    - supermatt 7y ago
      You can guess whatever you like - but Duo doesn't even support multiparty conferences in the browser...
      - 7y ago

BiteCode_dev 7y ago

Phone calls, emails, and text messages don't have e2e encryption, and we have been using them for 40 years. We are still using them. Nobody cares. The USA communications are under constant mass surveillance, by a group of people that denies it, abuses it, uses secret courts to rule about it even when unconstitutional, coerce others to submit every data and shut up about it, and destroy the life of whoever point finger at it. And people still don't care. Good luck with telling people that are recording their entire life on facebook, snapchat and tik tok to be mindful about the tools they use.

kristopolous 7y ago
Is it necessarily a problem? I've actually been bitten more by things that were encrypted without telling me when I went to try to restore things or do some kind of archiving. Encryption should be explicit and available, but optional in the same way I could leave my front door unlocked. The forcing of either direction is the real problem
- Legogris 7y ago
  It seems you are conflating transport encryption with encryption at rest. I can not imagine a scenario where encrypted end-to-end transit can "bite" you as there is no recovery scenario apart from snooping network operators/attackers.
  - eukgoekoko 7y ago
    E2E encryption can be really resource consuming, especially with the amount of traffic used for video chat. You might not want this just because of a worse user experience.
    - zrm 7y ago
      Video chat is something like 1.5Mbps. Even phones can do chacha20 at >1000Mbps these days. It's not that expensive. Where people start to feel it is if you want the server in the middle to be decrypting and re-encrypting everything, because it's not that much for one user but it starts to add up for a million users. But the obvious solution there is to use E2EE and then it isn't doing that.

mrfusion 7y ago

Is https considered end to end encryption? Why or why not?

prophesi 7y ago
HTTPS is point-to-point encryption. It's good for client <-> server communication. If you need to send data to another client through the server, then HTTPS won't suffice. The server decrypts the data and then sends it to the other client via HTTPS. So if there's more than two points (client <-> server <-> client) you'll need end-to-end encryption.
- mrfusion 7y ago
  Good point. So how would something like HN work with end to end encryption? I guess users see each other’s posts but the server can’t.
  - prophesi 7y ago
    Yeah, that'd be pretty tricky. End-to-end encryption is really easy to implement if you're sending data to only one user. It gets really hard and really slow once you start adding more users. A simple way would be to encrypt your message with a symmetric key. Then encrypt this symmetric key with your private key, and create a copies of it for each recipient and encrypting it with their public key. So each recipient can decrypt the symmetric key and use that to decrypt the message. You can probably guess that this gets really messy as you start adding more users. And you need to know the difference between symmetric key encryption and public key encryption. It's probably better to look at a peer-to-peer solution, or find a more efficient protocol. This is a pretty enlightening StackOverflow post on the subject: https://security.stackexchange.com/questions/126768/which-protocols-exist-for-end-to-end-encrypted-group-chat/127331#127331 https://security.stackexchange.com/questions/126768/which-pr...
    - snarf21 7y ago
      Most public/private use symmetric encryption for the data anyway but they use a key derivation scheme to share the key. You can't use public/private encryption for data size greater than the key size. Obviously you can sign/verify any data size. Also, above you said "encrypt this symmetric key with your private key", did you mean sign this symmetric key?

est 7y ago

Does e2e work with a large group of people video conferencing? I thought encryption might get pretty expensive if 1080p streaming directly between peers. For a team of 30 people it eats bandwidth quickly. If there's some kind of server (or supernode) transcoding, does transcoding work with e2e?

supermatt 7y ago
Yes, you can have e2e encryption videoconferencing with large groups of people - just not using webrtc (unless you do some crazy hacks - mentioned in my other comment). By definition, a transcoding server or supernode (acting as an MCU - Multipoint Conferencing Unit) would be a MITM, so that wouldnt be e2e encrypted. A simple way with WebRTC for a small conference, would be to transcode on the origin and provide multiple streams to peers - one for thumbnails, one for higher quality, low bandwidth fallbacks, etc. This doesnt scale well, but it works nicely for small conferences.

ghgr 7y ago

At my company we use a self-hosted Nextcloud instance with the Talk plug-in. It has chat, video, audio and screen-sharing. It may not be E2E encrypted, but the data never leaves our servers. It also makes a better impression when you share a <own_company>.eu link instead of a .webex.com or .zoom.us link.

kreetx 7y ago
The Sextcloud homepage says it has "encrypted, peer-to-peer audio/video calls", so it probably is end-to-end encrypted, at least for two-people calls. Conference calls probably not, since they say "Individual and group calls & chat" (i.e not mentioning encryption).

josteink 7y ago

Does the average person care? Probably not.

ezg 7y ago

I'm with Silent Circle all the way. Love their video and conference calling features and it's encryption I completely trust.

Erlich_Bachman 7y ago
Why do you completely trust it?
- ezg 7y ago
  I'll be upfront, I'm a little biased... my dad wrote ZRTP and helped design the encryption on the Silent Phone app. There are a number of reasons I trust it. One is that the user is involved in authenticating the call. Most other encryption apps bury that authentication in the settings, allowing you to not worry your pretty little head about it. I trust both the good intentions behind the design as well as the implementation.
  - Erlich_Bachman 7y ago
    But if it's not open source...?
    - dexterdog 7y ago
      Does Phil Zimmerman still work for them?
ezg 7y ago
https://www.silentcircle.com/ https://www.silentcircle.com/

d0100 7y ago

I could quite understand what he meant about WebRTC, is it encripted, but not super encripted, or is it such a junky encription that a script-kiddy can decrypt it? Just launched a product that uses WebRTC and we have a marketing blurb that says that our P2P WebRTC is encrypted. Is that wrong? Twilio says it is

supermatt 7y ago
It is encrypted, yes. The discussion is over end-to-end encryption - i.e. is there a middle server that has access to the unencrypted streams, or do peers communicate directly with each other. This depends on your implementation.

EvgeniyZh 7y ago

Let's switch to Tox

hprotagonist 7y ago

my understanding is that group FaceTime calls really are E2E. i don’t know about skype, and i don’t think Signal even supports it.

101404 7y ago

Should I care? My conversations in a Café don't have e2e either.

hypewatch 7y ago

> Does your video call have end-to-end encryption? Probably not. This headline is inaccurate. FaceTime has end-to-end encryption and is one of the most popular video call apps used for personal calls. https://www.apple.com/privacy/features/ https://www.apple.com/privacy/features/

cgh 7y ago
A lot of people here probably won't believe this, but Cisco Webex offers end to end encryption, but not by default. If you use it, you lose a bunch of features. But it is available, and Webex is immensely popular in the corporate world. https://help.webex.com/en-us/WBX44739/What-Does-End-to-End-Encryption-Do https://help.webex.com/en-us/WBX44739/What-Does-End-to-End-E...
bryanmgreen 7y ago
Not an Apple die-hard (have never owned one of their computers) but their privacy efforts are, for me, increasingly a reason to either own or use their products. I think privacy will be the backbone of Tim Cook's legacy.

marknadal 7y ago

This was a really informative article, thank you. For anybody that is interested in an Open Source example of the "mesh" that is E2EE that the article mentions (tho not scalable, without switching to SFU & doing what they say), you can check out this repo ( https://github.com/meething/webrtc-gun https://github.com/meething/webrtc-gun ) that our community built in a couple of days. https://mozilla.org/builders https://mozilla.org/builders is an 8 week paid hackathon Mozilla is sponsoring, and teams are forming there, thinking about building a better Open Source E2EE multi-party Zoom alternative.