Hey, it’s Jorge the CTO of Slingshow here. The security claims refer to all the video/audio in the product and were passed on from our video infrastructure providers[0][1]. Unless you are recording on the Stage, the video/audio doesn’t touch our servers. The WebRTC protocol actually mandates connections and signaling are encrypted with the Secure Real Time Protocol (SRTP).
But, I’ve spent the last hour reviewing the details and Daily mentions end to end encryption for P2P calls only and it seems Agora doesn’t mention it at all! It seems the WebRTC SFU servers (middlemen needed for calls greater than 4ish) require encryption and decryption server side breaking end to end encryption. This was all really concerning to me, and I think Agora used to claim they were end to end encrypted[2] and then their marketing became part of our marketing early on :(. I have removed all security claims from our website as we reevaluate how we approach security. Sorry about this HN.
But, I’ve spent the last hour reviewing the details and Daily mentions end to end encryption for P2P calls only and it seems Agora doesn’t mention it at all! It seems the WebRTC SFU servers (middlemen needed for calls greater than 4ish) require encryption and decryption server side breaking end to end encryption. This was all really concerning to me, and I think Agora used to claim they were end to end encrypted[2] and then their marketing became part of our marketing early on :(. I have removed all security claims from our website as we reevaluate how we approach security. Sorry about this HN.
[0] https://docs.agora.io/en/Agora%20Platform/security?platform=...
[1] https://www.daily.co/security
[2] https://news.ycombinator.com/item?id=23026101