Password protection and additional E2E encryption layer

[holtwick]

Scenario

Somebody guesses the room name and can listen or manipulate the conversation.

Solution

1. When creating a new room it has to be flagged as either public or private
2. If private the clients have to negotiate via WebRTC if they trust each other, usually by proving to know a common secret

Discussion

• What happens if the signaling server is compromised?
• Prevent brute force attacks

[holtwick]

Depends on #16

[holtwick]

Check against German BSI Video Conf Compendium

[holtwick]

Comments about security concerns of WebRTC and E2EE: https://news.ycombinator.com/item?id=23523830#23524987

[holtwick]

The main goal was achieved by implementing #55 If somebody like to to fund this feature, I'll add it. Otherwise I don't think it is super important any more. In case I would implement it, I would not store anything on the signal server but instead already encrypt any communication that goes through the signal server as well.

[holtwick]

https://saltyrtc.org/pages/why-saltyrtc.html