News for hackers. Stuff that matters.
Re:You’re muted – or are you? Videoconferencing apps may lis... by georgyo on Wednesday April 13, 2022 @02:16PM (#31018205)
I think there are two different problem here.

1. When the mic is soft muted, information is getting sent to the conference provider which could leak information about private matters.

2. When the mic is not muted all information is definitely going to the conference provider in a way they can decrypt so they can mix it.

That is to say that when using most conference software, you have already granted then access to contents of the meeting.

If you can't trust them to not miss use information they get when the mic is off, then you also can't trust them when the mic is on.

Re:You’re muted – or are you? Videoconferencing apps may lis... by markstos on Wednesday April 13, 2022 @02:37PM (#31018463)
End-to-End encryption for group video and audio is now supported. I'm not sure it works or who is supporting besides Signal, but it is apparently not not required that the conference provider decrypt the streams to mix them.

https://mashable.com/article/signal-end-to-end-encrypted-gro...

Re:You’re muted – or are you? Videoconferencing apps may lis... by KennyBlanken on Wednesday April 13, 2022 @02:43PM (#31018527)
Element/Matrix also support e2ee.

Jitsi has supposed e2ee videoconferencing (on Chrome - they used some chrome-specific API for processing) for (I believe) at least a year or two.

Re:You’re muted – or are you? Videoconferencing apps may lis... by feanaro on Wednesday April 13, 2022 @03:00PM (#31018763)
The API is called Insertable Streams. It's not actually supposed to be Chrome-specific, others are just lagging in implementing it.

Element has native E2EE for 1-to-1 calls, but uses Jitsi for group calls. Native E2EE group calls actually also exist, called Element Call (https://element.io/blog/introducing-native-matrix-voip-with-...) but they're yet to be integrated into Element and specced into Matrix, I believe.

Re:You’re muted – or are you? Videoconferencing apps may lis... by BlueTemplar on Wednesday April 13, 2022 @05:03PM (#31020240)
Jitsi's own solution I assume (also on Jitsi Meet), and not the usual XMPP/Jabber that (non-Meet) Jitsi uses ?
Re:You’re muted – or are you? Videoconferencing apps may lis... by hunter2_ on Wednesday April 13, 2022 @04:12PM (#31019677)
> it is apparently not not required that the conference provider decrypt the streams to mix them

I don't believe this could be true, and the linked article doesn't have the word "mix" anywhere. I imagine that there is no mixing happening until after decryption on the client device. Of course this means that every audio source goes to each recipient discretely, which means more bandwidth, but audio (especially near-silent moments therein) is lightweight enough for reasonably sized groups. Obviously this same n^2 scaling issue happens with the video anyway which is never mixed.

Re:You’re muted – or are you? Videoconferencing apps may lis... by pthatcherg on Wednesday April 13, 2022 @05:48PM (#31020717)
That's correct. You can't mix without decrypting. Signal does not mix at the server because it can't.

More info is available at my blog post about it: https://signal.org/blog/how-to-build-encrypted-group-calls/

Re:You’re muted – or are you? Videoconferencing apps may lis... by hunter2_ on Sunday April 17, 2022 @12:10AM (#31058412)
Good stuff, thanks!