A client is looking for a secure alternative to call people; an at risk user is concerned about making calls which can be monitored or intercepted; a client uses Skype, Google Hangouts, or other commercial services for sensitive voice/video chat
Edit me

Recommendations on VoIP/video Chat Tools

Secure solutions for voice/video calls

Problem

  • Secure communications via email may not be possible or suitable in a specific situation.

  • Telecommunications companies may try to monitor or intercept calls going through their network.

  • Popular tools like Skype or Zoom are not advisable solutions for human rights defenders at risk.

  • Depending on their threat model, other commercial services like Google Hangouts can also be contraindicated.

Solution

1:1 video calls

For end-to-end encrypted 1:1 voice and video calls, we can recommend:

  • Wire - an open source desktop and mobile app for end-to-end encrypted messaging and voice & video calls. No phone number is required to sign up. Messaging supports both 1:1 and group conversations, and calls support both 1:1 calls and group calls with 10 or fewer participants. For more information on calls, check the section on Multi-party video calls below.
  • Signal - an open source desktop and mobile app for end-to-end encrypted messaging and voice & video calls. A phone number is required to sign up. Signal supports messaging for 1:1 and group conversations, and supports both 1:1 calls and group calls for groups of eight or fewer people.

Multi-party video calls

Both Wire and Signal provide end-to-end encrypted video and voice calls. However, as both services only allow group calls with a small number of participants (maximum 10 for Wire and 8 for Signal), there might be cases where these platforms do not fit everyone’s needs.

On platforms where group video calls are not end-to-end encrypted, their security depends on TLS/HTTPS being properly implemented, and on the entity that is hosting the service. When choosing a platform, the user is trusting that platform with the confidentiality of their conversations. If the client does not feel comfortable trusting another party with access to this information, then they may need to explore the possibility of self-hosting, or find a platform they do trust.

Multi-party video learning platforms

If the client is interested in hosting remote video learning, they may want to consider using the open-source video platform BigBlueButton. There are some commercial providers that also offer hosting support if the client doesn’t have the technical capacity.

Voice calls

If video is not strictly necessary, and bandwidth is low, it is worth proposing multi-party audio calls. Mumble is an open source, low-latency, high quality voice chat software that can be self-hosted on the client’s server.

Comments

Rocket.Chat - an open source fully featured Slack clone - has plugins for webrtc videobridging and OTR-encrypted chat conversations. It can be self-hosted as a standalone, or within a sandstorm.io instance, and could be more useful for organizations looking to consolidate Slack-style communications with a voice option.

If we consider other tools for voice and video call, we should use the Confidentiality-Integrity-Availability Framework to evaluate them and make sure that they include these features:

  • Cross-platform
  • End-to-End encrypted whenever possible
  • Documented
  • Easy to install
  • User-friendly
  • Containing user authentication
  • Open source
  • Hosted by trusted entities

For more information on how to choose a video conferencing platform, consult the following resources:

Tags: secure_communications articles