Comment by Aachen | Hacker News Reader

Comment by Aachen | Hacker News Reader

Parent Full thread

If you want my popular products then nobody can answer because you'd know of them already. So I'll generalize to what group video tools are e2ee:

-> Jami (according to their website, I only ever used their chat and regular one-on-one calls)

-> Wire (client and server open source, but not community-lead development)

-> WhatsApp (if you trust Facebook, proprietary back-end)

And if you consider open source & on-premises / "can be completely locked off from the Internet so only you can access it" software to be end to end encrypted (if you personally run the server, you're one of the endpoints):

-> Jitsi Meet (full e2ee is under development, collab with Matrix I think)

-> BigBlueButton

-> Apache OpenMeetings (I never used this one, can't vouch for it)

Signal and Threema don't do group calls as far as I can quickly find online, correct me if I'm wrong.

Anyhow, plenty of options whether you like to self host (saves a ton of CPU on encryption and lets the server do stream mixing) or have full end to end encryption. Why do you care whether they're used by a billion people / "popular"? You can still choose to use them and improve the status quo because why not?

- I was looking for "desktop-solutions" comparable to Zoom, so WhatsApp and Telegram are out of the question (Telegram doesn't do group calls AFAICS).

Some notes:

- Wire has published a detailed whitepaper on e2ee. https://wire-docs.wire.com/download/Wire+Security+Whitepaper...

- Jami (formerly GNU Ring) has an interesting post about having e2e here: https://security.stackexchange.com/a/162603/243716

- Jitsi e2e is testable, but they note that it's not completely finished. Key exchange has to be done manually.

- https://github.com/bigbluebutton/bigbluebutton/issues/9893 suggests BigBlueButton don't have e2e yet

- Wikipedia claims "no encryption protocol" for OpenMeetings https://en.wikipedia.org/wiki/Apache_OpenMeetings

---

So that leaves Wire and Jami. Thanks for the info!

Oh right sorry, Telegram indeed doesn't do group calls. Removed them from the list. Thanks!

As for Jitsi, BigBlueButton, and OpenMeetings, no indeed they don't do encryption currently, hence them being in the second section with open source self-hostable conference software rather than the e2ee section above. To me, depending on the use-case (if you can self host on a trusted system) that would be equally secure and also doesn't leak metadata (who calls who) to some central system.

Wire's most recent system (launched a few weeks ago to make the video conferencing more efficient, bumping max participants from 4 to 12) also tries to avoid learning who is in a conference with who, but fact is that if you observe their datacenter there'll be traffic going to certain IP addresses that starts and stops at the same time.

For what it's worth, to add my experience/recommendations: I really liked the BBB setups I've been in (largest was a hundred or so people) and would recommend that if you're looking for an alternative. Wire also works reasonably and because it's end to end encrypted you don't need your own setup to get started, but isn't as open source oriented as BBB/Jitsi and the CPU load from the encryption during video or screen sharing is quite significant. Jami, last I tested, was quite buggy, but that was way before the pandemic. Full disclose: so far I've only had to decline one Zoom request and so I've never been in a Zoom® call (not a single of our clients uses Zoom, yet people use the brand name as a synonym for video call? I don't get it), so I can't compare any of these with Zoom.

Can the key exchange even be both automatic and secure?

Reply on news.ycombinator.com