📝 Correction | Jitsi Meet is now E2EE

[lrq3000]

Description

Jitsi Meet is now E2EE, including the desktop app which is now regularly updated.

I think it's time to upgrade Jitsi Meet as a recommended option in VoIP (and I would even argue the top one since it's not only one of the only 2 voice calling app with E2EE, but also very easy to use - it's also the only opensource desktop app with a floating window ala Skype).

Why I am making the suggestion

Voice conferencing tools are very useful, even critical, in some instances as the recent world situation has shown. And unfortunately the most currently used tools are not the most secure.

My connection with the software

No link, just a (irregular) user.

• I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

[lrq3000]

I also strongly recommend to demote Mumble to a Worth Mention, as it violates the E2EE criterion as stated at the top of the instant messengers page:

We only recommend instant messenger programs or apps that support end-to-end encryption (E2EE).

I know that VoIP is a separate section but for the reader it's really not obvious. Also, although I love Mumble, privacy-wise there are two much better solutions with Jitsi Meet and Linphone, so it doesn't look like Mumble should stay...

[lrq3000]

Just for info, E2EE is also supported on p2p (1-on-1) connections.

[lrq3000]

Note also:

• the E2EE feature is still considered beta (although progressing quite fast and already deployed in the web app and desktop app - but not on Android).
• Since Riot uses Jitsi for multi-party voice/video calls, this may also allow Riot to support multi-party E2EE voice calls in the future.

[CristianAUnisa]

There was a discussion on the subreddit about the Jitsi's E2EE and I read that Firefox is not supported. The app seems like a good idea but I wonder why I can't find it on jitsi.org

[lrq3000]

Ah, I didn't know, but indeed that's correct, E2EE is not supported on Firefox yet because Firefox does not support Insertable Streams, which is an Emerging Web Specifications, and the basis for the E2EE implementation. This is currently being discussed between the Firefox and Jitsi Meet's teams. The relevant links to track this issue:

• 100% support for Firefox (and other non-Chrome browsers) jitsi/jitsi-meet#4758
• webrtc insertable streams mozilla/standards-positions#330

Side-note but interesting: Mozilla evaluated the security of Jitsi Meet 5/5 following a recommendation by the Tor Project. So it seems the folks at Mozilla want to support Jitsi Meet, we just currently wait for an official position (and then the technical implementation). From what I understand, Jitsi Meet's team tries to follow the best standards, but Firefox is a bit lacking behind, so it seems just to be a lack of time/resources but the thing will eventually get resolved (just like the other issues Firefox had with Jitsi Meet).

Meanwhile, indeed Firefox users can use the Jitsi Meet's electron app so they don't need to install Chrome. I am not sure why the electron apps aren't listed on the website, but I guess it's because of some mumbo-jumbo about certificates (the recently released apps don't have a certificate - but so are a lot of opensource projects!). I also just found that there is an issue on some Linux distributions such as Debian but a temporary fix is proposed here and a permanent one is being worked here.

So, in the end, I guess the PR should be put aside for the moment until Mozilla publish a position statement.

[dngray]

Make sure to see my pull request lrq3000#1

[CristianAUnisa]

@lrq3000 thank you for posting Mozilla's stance. Would it be good to insert a note about the E2EE suggesting the Jitsi app since it seems like a good alternative to other privacy-unrespecting apps?

[lrq3000]

@dngray yes tjank you, i will update the PRs accordingly.

@Asbesbopispa I'm not sure i understand what you suggest, but i have added a Experimental E2EE warning label about the issue with Firefox, as otherwise E2EE is indeed already deployed and working (and i also think jitsi meet is a nice alternative to other voice reunion softwares). Is that what you had in mind?

[CristianAUnisa]

@lrq3000 I was thinking about the fact that even if a lot of people hate electron, the app seems like a good idea from two perspectives:

it can be a good compromise instead of using Jitsi on Firefox (which has the issue mentioned before);
it's an alternative against video-calling services which are not respecting users' privacy.

There's another issue, which is the fact that Firefox is the only browser suggested for PC on the privacytools website and there isn't a Chromium-based alternative. That's why I would suggest to get the Jitsi app instead.
Thank you for answering me; I'd like to know if there are any downsides in my argument, so let me know what you think about it.

[lrq3000]

You are correct @Asbesbopispa, I tested the apps and they support E2EE, so they are indeed a good alternative instead of Chrome (and hence why we may already add Jitsi Meet as a recommendation IMHO).

I have updated my PR as follows:

• link in-text to the desktop apps, in order to nudge users towards using them instead of in-browser.
• the E2EE warning label now explicitly suggests to use the desktop apps until E2EE gets implemented in firefox:

E2EE in Jitsi Meet is dependent on Insertable Streams, which is currently supported in Chrome but not Firefox. The mobile apps also do not support E2EE for the moment. Prefer to use the desktop apps instead.

Do you think this is ok like that?

[CristianAUnisa]

@lrq3000 I think your update is alright; hope I didn't annoy you with my thoughts!

[lrq3000]

@Asbesbopispa No on the contrary you're very welcome! Thank you for your pertinent feedback :-)

[thansk]

I also strongly recommend to demote Mumble to a Worth Mention, as it violates the E2EE criterion as stated at the top of the instant messengers page:

We only recommend instant messenger programs or apps that support end-to-end encryption (E2EE).

I know that VoIP is a separate section but for the reader it's really not obvious. Also, although I love Mumble, privacy-wise there are two much better solutions with Jitsi Meet and Linphone, so it doesn't look like Mumble should stay...

Mumble servers a completely different demographic from Jitsi or anything else. It serves as an alternative to discord, as it offers PTT (which afaik, no other app offers). I don't think it should be removed.

[lrq3000]

@thansk Ah ok I didn't think about it, then I agree that Mumble is a better alternative to Discord. But they really should implement E2EE, I hope they will someday :-/

[cryptocat8]

I figured out 8x8 Video Meetings is better than normal Jitsi meet, if you are not self hosting. You should mention that too and it have some cool features too.

[lrq3000]

@Lostname777 The software needs to be opensource to be recommendable on PTIO, and it seems this one is not. Furthermore it doesn't appear to have E2EE, which Jitsi Meet provides now.

[cryptocat8]

@lrq3000 8x8 also have E2EE now, till now only in browser support like Jitsi Meet.