Securing Frappe Meet beyond transport encryption

Frappe Meet is an open-source video conferencing tool that is a part of the Frappe Suite. It uses WebRTC to send and receive the audio/video streams, which means that the data is encrypted only in transit using SRTP. But this might not be enough for folks who don’t want the media server to know what the streams are about.

In this talk, I’ll start by explaining the baseline security model of a WebRTC call. From there, I’ll walk through how we added E2EE to Frappe Meet.

We’ll go through the architecture, the key technologies we’ve used, and cover how participants establish shared cryptographic state, how keys are exchanged and rotated, how membership changes trigger new key epochs, and how WebRTC Insertable Streams are used to encrypt encoded audio and video frames on the client before it’s sent.

We’ll also cover the tradeoffs in using E2EE in real-time communications, including performance, browser compatibility, debugging issues, and feature loss (transcriptions, recording, etc.)

• Understand baseline security provided by popular video conferencing apps.

• Understand how frames from audio or video are encrypted and decrypted

• Understand how Meet handles group key exchange, key rotation, key epochs, and membership changes based on MLS

• Understand the trade-offs of using end-to-end encryption