3 ms·

In this case authentication is provided through a shared secret (the room name). An arbitrary MitM wouldn't know the room name since the connection to the serve

In this case authentication is provided through a shared secret (the room name). An arbitrary MitM wouldn't know the room name since the connection to the server is also encrypted. Unfortunately this isn't much of a secret, since the server also knows the room name, but it's a start. There is an open issue to add password-protected rooms which would fix that problem.

pizzazzaro 6y ago
From an user-centric standpoint, would not both secrets - roomname and password - be shared concurrently, potentially in the clear? This drastically limits the utility. Communication channels are only as secure as the least secure participant! Especially in shared-secret implementations. Every so often, Grandma wants to be cool too. And invite her friends.
Andrew_nenakhov 6y ago
In most e2ee threat models the biggest source of threat is the server that mediates the data exchange. Other threats are sufficiently thwarted with TLS, so ... ... these Briefing guys should better bring on these password protected rooms if they want to put this end to end encryption claim on their website.