Jitsi privacy flaw enables one-click stealth audio and video capture(zimzi.substack.com) |
Jitsi privacy flaw enables one-click stealth audio and video capture(zimzi.substack.com) |
The user has given permission for audio and videos recording to the jitsi domain during a previous meeting, and the domain is using those permissions to start an unsolicited meeting initiated by a 3rd party, who is given access to the video and audio of the victim.
It was disappointing to see the responses in the post. A curt "It's a feature" to a valid security concern & disclosure, and not replying to a request to publish.
Jitsi says "We encourage responsible disclosure for the sake of our users, so please reach out before posting in a public space.". But if no one bothers to reply, why bother to reach out to Jitsi in the first place?
https://jitsi.org/ says, literally in the hero image banner, "More secure" as the first thing you see. The handling of this raises some concerns about that. (If you don't want to be scrutinized as much about privacy & security stuff, I would recommend not advertising "more secure" as the first thing people see on the site)
config.prejoinConfig.enabled=false
config (which implicitly decides weather or not a prejoin dialog is shown)
but this makes me wonder
1. why can you set that config in a URL? Allowing users to set it for them-self seems fine, but allowing rooms or URL to use it seems ... off.
2. how many other sites have this attack surface (e.g. MS Teams) just more obscure
3. actually the moment the attacker controls JS probably *all* other video conference systems have the feature, through potentially needing a lot of additional work. In which case maybe just being straightforward and open about it is fine? But the cost of such an attack is just a very bit too low compared to other conference systems.
That said, I can't think of a reason why you'd want to permit it outside of very specific containers. Useful for integration, but outright bad design for a public instance.
I'm not a fan, either. I'm used to the interstitial page from other services, and in fact would not expect to join a call and stream data before hitting "join".
Jitsi is used in many custom solutions (which may have their own UI for getting user opt-in, like a customer hitting "Next step" in a registration wizard), I expect that's why they added it.
I e.g. would not complain if MS Teams (I have to use for work) would not put me into a pre join dialog every time I click join in Outlook but just joins me with mic muted/camera disabled by default. But then it also wouldn't be a security issue in my case as I put MS Teams and co. into it's own browser window/process/profile (not due to concerns but more as a side effect of them refusing to even trying to work on Firefox and not wanting to miss out on the tab sync + tab group + account container and not being allowed to install arbitrary extensions which add similar functionality to chrome).
yes it's a browser setting to "remember mic/camera permission for given site"
to which extend this "remember" is there by default, can be disabled through system config/MDA etc. is probably very
lastly iff that is a default for Safari on Mac I wouldn't be surprised if that was not only placed their to protect your safety but to annoy you and push you to use Mac, it would fit into a sad list of similar things done by Apple to push people to go through their app store. But then more safe is still more better for many users.
... browser specific
not sure where that words disappeared, too
(As in during the pandemic -- long ago in vuln times.)
I am willing to discuss it, off the record, if someone provides their signal information.
alongside of the abysmal UX for listing/removing them (from a "normal" user POV it's somehwhat usable for someone who understands tech a bit more)
like in general IMHO origin separation over time (e.g. permissions, cache, local storage) should be bound to some public key cryptography schema where the public key is shipped alongside DNS and every time it changes (or disappears) it's treated as a new origin.
So basically HPKP but 1. one key per origin, 2. separate from the TLS key, 3. way less harmful if messed up so actually just fine to use without worry to permanently lock yourself out.
Also maybe 4. crypto likeable to a group of person/company identity public keys detached from TLS and not spoofable by government DNS/TLS takeover attacks. But in a way where this system is added on top instead of being a building block to make it hard for regulators to effectively shut it down. Like I which police all luck to find all the criminals but history non stop shows we can't rely on governments not going crazy and start prosecuting people for just being different without different meaning "actively" hurting other people or entrapping and then persecuting people for having different political (or religious) opinions or other similar nonsense.