3 ms·

Jitsi Meet runs on your own server and lets you videoconference using just your browser and its built in support for WebRTC. That means it gets to leverage the

by joecot 7y ago

Jitsi Meet runs on your own server and lets you videoconference using just your browser and its built in support for WebRTC. That means it gets to leverage the readily available and easily understood security of: * Traditional Web Servers (Apache 2 or nginx) * https/ssl * modern web browsers Running a videoconference software that just works in your browser over https solves a large majority of security concerns. The video and voice is encrypted over SSL between the clients and the server. It's not end to end encrypted because that's not really possible, but the only place its unencrypted is in your browser and on the server you own and control. If you don't trust Jitsi's ability to password protect rooms, you could put normal http password authentication in front of your jitsi install -- which would break the mobile app but work just fine in your browser. Lots of the concerns of Zoom's security are resolved by using readily available standards and software instead of depending on proprietary black box solutions that turn out to send encryption keys through china. EDIT: As kardos notes below the video actually runs over udp on port 10000 so it is not encrypted over https. It looks like video is encrypted[1] but I'm unclear what method it's encrypted. 1. See Security section of Readme https://github.com/jitsi/jitsi-meet https://github.com/jitsi/jitsi-meet

kardos 7y ago
The web app runs on TCP/443 and benefits from your Let's Encrypt cert. Jitsi also exposes UDP/10000 for receiving streams from clients, which doesn't go through apache/nginx. So what does it do for encryption there?
- joecot 7y ago
  Fair enough. I just firewalled 10000 and tried talking to a friend and it does not work. The web app indeed runs over 443 but all the video conferencing is done over UDP. However WebRTC is always encrypted. So add on a 4th well tested piece of tech being utilized. https://webrtc-security.github.io/ https://webrtc-security.github.io/
  - kardos 7y ago
    Yeah, I'm not really suggesting that they failed entirely to encrypt the UDP traffic. But I am curious if what they have done has been scrutinized recently. Jitsi was formed in 2003 according to Wikipedia, there could be outdated choices in there somewhere. That they use widely deployed tech is not really enough, we've just seen that Zoom is using ECB mode when they should not, etc.

by joecot 7y ago

kardos 7y ago

The web app runs on TCP/443 and benefits from your Let's Encrypt cert. Jitsi also exposes UDP/10000 for receiving streams from clients, which doesn't go through apache/nginx. So what does it do for encryption there?

joecot 7y ago
Fair enough. I just firewalled 10000 and tried talking to a friend and it does not work. The web app indeed runs over 443 but all the video conferencing is done over UDP. However WebRTC is always encrypted. So add on a 4th well tested piece of tech being utilized. https://webrtc-security.github.io/ https://webrtc-security.github.io/
- kardos 7y ago
  Yeah, I'm not really suggesting that they failed entirely to encrypt the UDP traffic. But I am curious if what they have done has been scrutinized recently. Jitsi was formed in 2003 according to Wikipedia, there could be outdated choices in there somewhere. That they use widely deployed tech is not really enough, we've just seen that Zoom is using ECB mode when they should not, etc.