Hacker News new | ask | show | jobs
by cfstras 2052 days ago
- I was looking for "desktop-solutions" comparable to Zoom, so WhatsApp and Telegram are out of the question (Telegram doesn't do group calls AFAICS).

Some notes:

- Wire has published a detailed whitepaper on e2ee. https://wire-docs.wire.com/download/Wire+Security+Whitepaper...

- Jami (formerly GNU Ring) has an interesting post about having e2e here: https://security.stackexchange.com/a/162603/243716

- Jitsi e2e is testable, but they note that it's not completely finished. Key exchange has to be done manually.

- https://github.com/bigbluebutton/bigbluebutton/issues/9893 suggests BigBlueButton don't have e2e yet

- Wikipedia claims "no encryption protocol" for OpenMeetings https://en.wikipedia.org/wiki/Apache_OpenMeetings

---

So that leaves Wire and Jami. Thanks for the info!

2 comments

Oh right sorry, Telegram indeed doesn't do group calls. Removed them from the list. Thanks!

As for Jitsi, BigBlueButton, and OpenMeetings, no indeed they don't do encryption currently, hence them being in the second section with open source self-hostable conference software rather than the e2ee section above. To me, depending on the use-case (if you can self host on a trusted system) that would be equally secure and also doesn't leak metadata (who calls who) to some central system.

Wire's most recent system (launched a few weeks ago to make the video conferencing more efficient, bumping max participants from 4 to 12) also tries to avoid learning who is in a conference with who, but fact is that if you observe their datacenter there'll be traffic going to certain IP addresses that starts and stops at the same time.

For what it's worth, to add my experience/recommendations: I really liked the BBB setups I've been in (largest was a hundred or so people) and would recommend that if you're looking for an alternative. Wire also works reasonably and because it's end to end encrypted you don't need your own setup to get started, but isn't as open source oriented as BBB/Jitsi and the CPU load from the encryption during video or screen sharing is quite significant. Jami, last I tested, was quite buggy, but that was way before the pandemic. Full disclose: so far I've only had to decline one Zoom request and so I've never been in a Zoom® call (not a single of our clients uses Zoom, yet people use the brand name as a synonym for video call? I don't get it), so I can't compare any of these with Zoom.

Can the key exchange even be both automatic and secure?