PoC: end-to-end encryption in Jitsi Meet (Work in Progress)

[@MikeTrieu]

Nice demo! Can't wait to update my instance and play around with it 😁 Edit: You're using AES-GCM. You're already doing much better than Zoom with their ECB implementation. Bravo! "We use the room name as a salt in this key generation." Isn't that exactly what Diffie-Hellman was designed to do, generate shared secrets only the participants know? Yes, I'm well aware of the MitM risks associated with a naive DH approach.

[@NateROCKS112]

Currently it's a pre-shared key, so Diffie-Hellman isn't performed (excluding client-server transmission, obviously).

[@MrLoggfreak]

pretty damn awesome, haven't seen any other company try to do end2end encryption in the browser.

[@MrPikoka]

OMG! all of you are amazing!!

[@InayetHadi]

Wait, I was under the impression that Jitsi was secure end2end if I owned and controlled the server?

[@JitsiOrg]

And it is. This new change would make it trustable end-to-end even if you don't own the server.

[@InayetHadi]

@@JitsiOrg right on, thank you

[@konstantingrudnev8374]

@@JitsiOrg Wait, how it can be trustable, if I don't own the server ? What e2e mechanism behind it ? Any whitepaper or description how it's done ? Or you just enter some key via established HTTPS connection (browser) and the process of getting pre-shared key is done via side-channels, like XMPP+OTR ?

[@zhongruichen2601]

@@konstantingrudnev8374 It is done via WebRTC Insertable Stream. The complete writeup is here: Jitsi.org/e2ee

[@SKITTLELA]

Excellent! Once Firefox is fully supported, I'll start using Jitsi!

[@MichaelMantion]

why not use chromium? I do not understand why people are so tied to firefox. Personally I love qutebrowser but I admit it lacks some features.

[@alaingross6962]

And what about jitsi meet electron as standalone client ? github.com/jitsi/jitsi-meet-electron

[@bishopolis]

@@MichaelMantion they remember Mozilla before it gave up on the Mozilla Project, and they forget the new org is not the same one.

[@bishopolis]

@@alaingross6962 Electron? What's the memory usage like? (I hear anything with Electron basically needs 1Gb RAM for Hello-World D-: )

[@1900maniac]

What's the difference between this and a call that requires a password for entry?

[@FatihErikci]

Fantastic! Hope to have this in stable builds soon :) How is the load to user PCs when having lots of streams?

[@tippership]

@ Jitsi So, idiot question - how can we play with this right now? according to the blog "This is already enabled on our alpha deployments as well as on meet.jit.si and people will be able to start playing with it as the necessary features start trickling down the Chrome release pipeline. IMPORTANT NOTE: This is a demo of an e2e encrypted call and the feature is NOT YET intended for general availability, so play with it all you want, but, for now, in matters where security is paramount we still recommend deploying your own Jitsi Meet instance. " Is this something we can play with from the browser version right this second? I ask because I tried going to alpha.jitsi.net, and setting up some jitsi meets with some other devices I have, and tried adding the e2ee key parameter to the url, but that didn't take hold? I never could get the blocky encrypted video on other devices that hadn't passed the key parameter into the url as is shown here- I tried this on alpha.jitsi.net and the normal meet.jit.si , making a room then adding the #e2eekey=(something) then having someone else(another device of mine) join- but they entered the room everytime no prob. (Sidenote:I see it apparently works in chrome only right now(if you can get it working), which is what i'm testing all of this with to try to play with it; but i can't wait until Firefox gets it, which will be critical due to Firefox's privacy efforts being high compared to other browsers.)

[@MichaelMantion]

Firefox isn't a privacy king, they are up to the same shady social justice we know best crap. they just don't disclose what they do. Chromium is more private and there are many, many other browsers that are more private.

[@borisgrozev2289]

@Tippership, you can play with it on meet.jitsi.net directly using Chrome Canary, there's a UI for it under the "more" button (lower right).

[@tippership]

Got it working, but you have to grab Canary, enable experimental web platform features in Google chrome canary, then i had to use alpha.jitsi.net, the meet.jit.si site isn't working though they said it should as well

[@borisgrozev2289]

@@tippership Thanks for the tip! It was unintentionally disabled on meet.jit.si with the latest release. It is back up again now!

[@tippership]

@@borisgrozev2289 Yep! Just gotta enable Experimental Web Platform features at Chrome://Flags , then it works! This is awesome! Here's hoping Firefox compatibility comes soon! You guys rock!

[@pedro_bezerra]

like! gostei muito do trabalho de vocês

[@arivonto]

Awesome Jitsi ❤🙏

[@alstermediamoingmbh7486]

Great Video! 😍 ...👍

[@claudioita9]

Work in progress means now is not end to end? Or they are referring to end to end with 3 and more concurrent users?

[@MikeTrieu]

For more than two participants, that is currently correct. It must go over the Videobridge, which would technically have the ability to surveil all streams passing through it. With Insertable Streams, this will no longer be the case.

[@claudioita9]

@@MikeTrieu Can you please answer the following: if jitsi server is hosted somewhere (that you feel is not safe/secure) if there are 2 participants only doing the call between them, the owner of the server has a way to view/listen the communication?

[@unarei]

@@claudioita9 For 2 participants, no, it is fully end to end encrypted.

[@MrParadise]

Jitsi is going down and will never beet the others trust me

[@w1of70046]

to be honest, I beleive this demo is just fake. I've myself in some Jity Conferences and to say right outv is has been just awful quality in bot video & audio. There other tools easy like Jitsy to operate but good quality, with free versions and business solution to resanable prices.

[@MichaelMantion]

#Music ruins the video,, get rid of the music. Silence is better than music. #video is too long, should be 5 secconds or have more information #Keep the words up longer on the screen some of us watch videos at 5x speed and don't want to have to go back and pause video #Get rid of the pointless stuff and don't repeat yourself. In other words its a terrible video that got likes for some reason. My guess is its the only video talking about Jitsi E2EE

[@climatechangedoesntbargain9140]

I love the video - are you being ironic?