What’s going on? Starting on August 24th, we will no longer support the anonymous creation of rooms on meet.jit.si, and will require the use of an account (we will be supporting Google, GitHub and Facebook […]
While Jitsi is open-source, most people use the platform they provide, meet.jit.si, for immediate conference calls. They have now introduced a “Know Your Customer” policy and require at least one of the attendees to log in with a Facebook, Github (Microsoft), or Google account.
One option to avoid this is to self-host, but then you’ll be identifiable via your domain and have to maintain a server.
As a true alternative to Jitsi, there’s jami.net. It is a decentralized conference app, free open-source, and account creation is optional. It’s available for all major platforms (Mac, Windows, Linux, iOS, Android), including on F-Droid.
Privacy has not diminished, you can host your own instance of the jitsi software account-free and take on the liability of people using your server for child porn yourself if you want to.
@esaru@bmaxv@technology concur that this reduces privacy for users of Jitsi’s hosted service. It also has some concrete benefits for Jitsi - they get to outsource account validation and security. Perhaps they were struggling to contain abuse.
@gunpachi
There’s jitsi the software and jitsi the page. This affects only jitsi the page. There are many more pages where jitsi the software is reachable at. @esaru
Thanks. I am aware of other instances, but my friends and family don’t understand the point of it. Anyways… I’ll see if I can get them to try other instances of Jisti.
Tell them that it works the same way, no registration too, but the old one had to shut down.
Technically, it did shut down, for those that don’t want to log in with anything.
Earlier this year we saw an increase in the number of reports we received about some people using our service in ways that we cannot tolerate. To be more clear, this was not about some people merely saying things that others disliked.
Cannot be less clear.
Anyway I don’t understand why you’d need an account. I’ve always created rooms and share the link to people to invite. You can setup a password if you want privacy. Any reason to login?
They are probably talking about using it to share CSAM or other illegal content. They need one person to login to be not anonymous so they can give it to the authorities if necessary.
And they’re added to spam lists all the time. All you need do is draw up a list of the twenty most popular, because frankly Gmail and outlook already cover so many while leaving room for privacy-friendly providers.
Yepp I agree, that kind of cryptic speak and this kind of drastic action taken by a FOSS project likely eludes to something of this nature IMO.
If they want to continue to appeal to businesses they’re almost certainly not going to release a statement saying people were sharing illegal material on our platform especially when they’re not a big well-known company like Facebook, Google and Microsoft, where normal people tend to disappointingly dismiss bad findings with a “benefit of the doubt” stance.
I assume their hosted version doesn’t have this limitation? In that sense, this news really is a non-issue I think, considering everyone usually has one of those three accounts. Someone looking for privacy should probably host their own IMO
I don’t understand, even if I use a google login I haven’t necessarily give my real name to google so why is it safer for them? Anyone can create a new email with google and particularly people sharing illegal material wouldn’t use their real personal email so what’s the point?
Is a mobile phone number not required for a Google account? In many countries, including all EU ones, you need to authenticate yourself when ordering a SIM card. This makes your phone number your personal ID. Your Google account is connected to your person, and what you do on Jitsi after logging in with your Google account as well. It’s easier to track back to you that way.
Yeah I didn’t think about the phone number, I made my google account a long time ago and they didn’t use to ask you for your number but now every service needs it for “security” reasons
Law enforcement can subpoena Google for breadcrumbs, and then go to data brokers for the missing pieces. It’s not perfect, but this likely isn’t the reason for Jitsi doing this.
The real reason likely falls along the line of the extra requirement driving people away from misusing the service, if they now need a VPN + killswitch and a burner “faang” account to share illegal content. They’ll just go to the next common denominator sadly, resulting in truly anonymous services dropping like flies (anonfiles.io being the last example of this)
There was likely a broad campaign of abuse that violated some sorta law. There’s not really another reason for this move short of something that puts them in an untenable situation.
This is about the free publicly hosted instance, used by the majority of the Jitsi users, who used it because they didn’t have to login with a Google/Facebook/Github account. Which they now have to.
Lol, it was my GOTO specifically because it doesn’t require a login and I can send it to my parents who need minimal clicks to enter the room. I even have family that doesn’t have a github, facebook, nor google account, so they won’t be able to join.
Amazing move Jitsi.
Earlier this year we saw an increase in the number of reports we received about some people using our service in ways that we cannot tolerate. To be more clear, this was not about some people merely saying things that others disliked.
What kind of “illegal things” were they doing? Say it, so that we can comprehend. Make it make sense.
Safe to assume it was child porn, because that ends up being an issue on any service that lets people share images or video privately. By not stating it directly, they don’t prompt news organizations to quote the company in click bait articles about how their platform enables child porn as if that wasn’t a universal issue that all services have to actively discourage.
But won’t those criminals always find another way of communicating? If you’re doing something illegal, it’s worth it to you to go through some hoops to have safe and private communication. All this does is remove that option from less tech literate people.
That doesn’t make it a non-issue. Ignoring the obvious ethical issues, there are still serious costs to addressing conduct they’re made aware of, both in terms of actual man hours and mental health of any employees, and the actual bandwidth of the abusive traffic.
You can self host it as well. This is just a restriction of the online service - the problem being that most people are not going to self-host their conference calls.
That said, it is completely understandable that some users may feel uncomfortable using an account to access the service. For such cases we strongly recommend hosting your own deployment of Jitsi Meet. We spend a lot of effort to keep that a very simple process and this has always been the mode of use that gives people the highest degree of privacy.
Seems like you can avoid it by self-hosting. Still a very suspicious move, kinda defeats the whole point of an alternative to big tech conference services.
Google, GitHub and Facebook for starters but may modify the list later on
Maybe they could support some auth provider from some fediverse app? That would be kinda neat.
Earlier this year we saw an increase in the number of reports we received about some people using our service in ways that we cannot tolerate. To be more clear, this was not about some people merely saying things that others disliked.
Over the past several months we tried multiple strategies in order to end the violations of our terms of service. However in the end, we determined that requiring authentication was a necessary step to continue operating meet.jit.si.
This sounds to me like a pattern of people using it for actual serious crimes (with the obvious guess being video sharing of sex crimes/trafficking/kids). I understand that that justification is used for a lot of extremely invasive privacy violations, and stuff like scanning every file in the name of that is too far, IMO, but if you’re the only platform with resources to handle that traffic that allows anonymity, it’s very likely to grow at a significantly larger rate than the rest of your traffic.
You can’t (shouldn’t) scan every file every individual sends to every other individual in order to prevent it, but once you have a platform that’s capable of supporting community-type activity, it’s a very real issue that you can face.
“You can host yourself with your own choices on vetting participation because here are the tools to do it” isn’t really a bad line to draw. But you can’t have your servers be a central point for that.
It’s hypocritical to call your service “privacy friendly” and then require the use of a Google/Facebook/GitHub account to log in. I kinda understand the reason why they do this, but they could have at least allowed you to use a more private email provider.
The software is free open source. But this case is not about the software. It’s about the web instance that the majority of the people was using. And that instance now lost its privacy feature and shouldn’t call itself privacy friendly anymore.
I agree with you and it’s an important distinction. But for me it’s also about the ethos of the developers or company. Promoting free and open source tools is great, but requiring the opposite as a prerequisite to use the largest publicly facing implementation of that is a very odd decision.
Is there another OAuth identity provider they should use? I agree that it’s ludicrous that advertising companies are the primary identity providers we use, but I have no issue with GitHub / Microsoft as an identity provider.
At the end of the day they could create their own account system and take on the liability of storing passwords, but why? That’s not what their software is about and as instance admins it will take away their time and focus.
At the end of the day I think what you’re chafing against is not their fault but a fundamental problem with open source software at the moment, we have no system of decentralized identity verification, and identity verification is basically a necessary part of ensuring your system isn’t abused.
I’d personally prefer they didn’t implement any KYC-style identity verification at all in the first place, but it’s not my service or project and I’m not a paying customer, so my preference is largely irrelevant to them. But that said, I didn’t intend the comment to be damning, or even a particularly harsh criticism, just thought it wad an odd choice.
If what you are saying is accurate, and there aren’t better options, I at least understand that choice a bit more. If they feel they need an identity provider for whatever reason, they should obviously choose the one they feel best fits that need. And as others have noted, different servers and instances can be spun up or utilized. Users can choose to utlize whichever fits their needs best, or none if none of them fit.
Your other point is well taken though that it may be a gap in the marketplace. Sounds to me like a need waiting to be filled. I recall reading about some decentralized blockchain solutions for this sometime back, but do not recall the specifics. I haven’t followed along because it didn’t seem relevant to my personal or business needs at the time.
If anyone else knows of alternative options that may be better or more privacy friendly, I’d certainly be interested to hear about them. And would chip in funding for any good FOSS projects that might seek to solve this problem.
The comment to which I replied complained that they claim their service to be privacy friendly. They didn’t complain about the open source claim, and me neither.
@owiseedoubleyou
It’s more likely about OIDC and not “email”. In which case they could have included Gitlab I guess. Let’s give them a while, they’ll probably figure out a list, this sounds like “how can we cover largest amount of people while adding fewest providers” @esaru
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
@esaru
“One option to avoid this is to self-host, but then you’ll be identifiable via your domain and have to maintain a server.”
Makes it a non issue.
It’s free as in freedom not as in free beer and that’s that.
Jitsi doesn’t have to offer free service and they particularly don’t have to provide anonymity.
The same is true for the fediverse, since the admins have info that could help identify users. That has it’s uses too.
Jitsi remains free. As you can see, this isn’t about money but rather about privacy, which has diminished compared to before.
The issue with centralized systems becomes more apparent: the provders are held accountable for their users’ actions.
Privacy has not diminished, you can host your own instance of the jitsi software account-free and take on the liability of people using your server for child porn yourself if you want to.
@esaru @bmaxv @technology concur that this reduces privacy for users of Jitsi’s hosted service. It also has some concrete benefits for Jitsi - they get to outsource account validation and security. Perhaps they were struggling to contain abuse.
RIP
deleted by creator
This is indeed sad news. I made my friends (who don’t care about free software) switch from google meet to jitsi for video calls just the other month.
The only thing that got them sold on jitsi was that it required no login.
deleted by creator
@gunpachi
There’s jitsi the software and jitsi the page. This affects only jitsi the page. There are many more pages where jitsi the software is reachable at.
@esaru
Thanks. I am aware of other instances, but my friends and family don’t understand the point of it. Anyways… I’ll see if I can get them to try other instances of Jisti.
Tell them that it works the same way, no registration too, but the old one had to shut down.
Technically, it did shut down, for those that don’t want to log in with anything.
Cannot be less clear.
Anyway I don’t understand why you’d need an account. I’ve always created rooms and share the link to people to invite. You can setup a password if you want privacy. Any reason to login?
They are probably talking about using it to share CSAM or other illegal content. They need one person to login to be not anonymous so they can give it to the authorities if necessary.
But why a Google/FB/MS account? Why isn’t an email account from an established provider enough, why centralise to three megacorps?
There’s plenty of disposable email services out there.
And they’re added to spam lists all the time. All you need do is draw up a list of the twenty most popular, because frankly Gmail and outlook already cover so many while leaving room for privacy-friendly providers.
Because these three provide federated login most email providers do not.
I didn’t think I’d unironically hear “This is an advantage because now one company controls all your logins” as a reply to privacy concerns.
I didn’t say that. Security and privacy are nearly opposites. This is a security decision.
Yepp I agree, that kind of cryptic speak and this kind of drastic action taken by a FOSS project likely eludes to something of this nature IMO.
If they want to continue to appeal to businesses they’re almost certainly not going to release a statement saying people were sharing illegal material on our platform especially when they’re not a big well-known company like Facebook, Google and Microsoft, where normal people tend to disappointingly dismiss bad findings with a “benefit of the doubt” stance.
I assume their hosted version doesn’t have this limitation? In that sense, this news really is a non-issue I think, considering everyone usually has one of those three accounts. Someone looking for privacy should probably host their own IMO
I don’t understand, even if I use a google login I haven’t necessarily give my real name to google so why is it safer for them? Anyone can create a new email with google and particularly people sharing illegal material wouldn’t use their real personal email so what’s the point?
Is a mobile phone number not required for a Google account? In many countries, including all EU ones, you need to authenticate yourself when ordering a SIM card. This makes your phone number your personal ID. Your Google account is connected to your person, and what you do on Jitsi after logging in with your Google account as well. It’s easier to track back to you that way.
Yeah I didn’t think about the phone number, I made my google account a long time ago and they didn’t use to ask you for your number but now every service needs it for “security” reasons
Law enforcement can subpoena Google for breadcrumbs, and then go to data brokers for the missing pieces. It’s not perfect, but this likely isn’t the reason for Jitsi doing this.
The real reason likely falls along the line of the extra requirement driving people away from misusing the service, if they now need a VPN + killswitch and a burner “faang” account to share illegal content. They’ll just go to the next common denominator sadly, resulting in truly anonymous services dropping like flies (anonfiles.io being the last example of this)
There was likely a broad campaign of abuse that violated some sorta law. There’s not really another reason for this move short of something that puts them in an untenable situation.
ITT: People not understanding the difference between a free publicly hosted instance and the OSS tool itself.
This is about the free publicly hosted instance, used by the majority of the Jitsi users, who used it because they didn’t have to login with a Google/Facebook/Github account. Which they now have to.
Good thing that you can still self host it, post your favorite jitsi instances below for everyone to use.
I’ll start with this one: https://calls.disroot.org/
https://meet.vpsfree.cz 💪
Thanks for that link. I didn’t know disroot hosted Jitsi.
For others in this thread, here’s a list of Jitsi instances: https://jitsi.github.io/handbook/docs/community/community-instances/
Well looks like jitsis gone.
The sky is falling the sky is falling!
You can also use matrix. Matrix currently uses jitsi. In the future it’ll use “element call” but right now, jitsi.
Ah. Thank you. Decent work around, still more steps sadly enough, but it’ll have to do.
I really hope this doesn’t become a trend, but every time I see a few buttons for signup with email coming last I have to wonder.
Lol, it was my GOTO specifically because it doesn’t require a login and I can send it to my parents who need minimal clicks to enter the room. I even have family that doesn’t have a github, facebook, nor google account, so they won’t be able to join.
Amazing move Jitsi.
What kind of “illegal things” were they doing? Say it, so that we can comprehend. Make it make sense.
Safe to assume it was child porn, because that ends up being an issue on any service that lets people share images or video privately. By not stating it directly, they don’t prompt news organizations to quote the company in click bait articles about how their platform enables child porn as if that wasn’t a universal issue that all services have to actively discourage.
If I’m reading it correctly, you only need one person in the meeting to have one of those accounts.
Tbf I’d not get angry if it was jihadist recruitment, child porn, human trafficking, etc. etc.
But won’t those criminals always find another way of communicating? If you’re doing something illegal, it’s worth it to you to go through some hoops to have safe and private communication. All this does is remove that option from less tech literate people.
But now the illegal content is not happening on their owned instance, taking them off the hook.
Communication network providers in the EU generally aren’t liable for illegal activity of their users.
That doesn’t make it a non-issue. Ignoring the obvious ethical issues, there are still serious costs to addressing conduct they’re made aware of, both in terms of actual man hours and mental health of any employees, and the actual bandwidth of the abusive traffic.
@elouboub
@esaru
Shodan finds 21k instances. https://meet.ffmuc.net/ and https://meet.element.io/ are just two, and I don’t expect them to require log in.
I’m on mobile, but does meet.element.io just work? I would expect that to only work for Matrix users
@ReversalHatchery
Just verified (from mobile) and it just works 🤷
If its open-source, couldn’t somebody just fork it and remove the login requirement?
You can self host it as well. This is just a restriction of the online service - the problem being that most people are not going to self-host their conference calls.
Yeah they’d have to maintain upgrades security patches etc and could get pricey depending on how much storage and bandwidth is involved.
Come on, one more step and you’ll get to the part where you have to deal with preventing other people from using your instance for child porn.
Or you could just restrict it for use by a select few you know.
Seems like you can avoid it by self-hosting. Still a very suspicious move, kinda defeats the whole point of an alternative to big tech conference services.
Maybe they could support some auth provider from some fediverse app? That would be kinda neat.
This sounds to me like a pattern of people using it for actual serious crimes (with the obvious guess being video sharing of sex crimes/trafficking/kids). I understand that that justification is used for a lot of extremely invasive privacy violations, and stuff like scanning every file in the name of that is too far, IMO, but if you’re the only platform with resources to handle that traffic that allows anonymity, it’s very likely to grow at a significantly larger rate than the rest of your traffic.
You can’t (shouldn’t) scan every file every individual sends to every other individual in order to prevent it, but once you have a platform that’s capable of supporting community-type activity, it’s a very real issue that you can face.
“You can host yourself with your own choices on vetting participation because here are the tools to do it” isn’t really a bad line to draw. But you can’t have your servers be a central point for that.
RIP Jitsi ಠ_ಠ
It’s hypocritical to call your service “privacy friendly” and then require the use of a Google/Facebook/GitHub account to log in. I kinda understand the reason why they do this, but they could have at least allowed you to use a more private email provider.
Calling them hypocritical is hysterical when they offer all the source code for free and you can host your own instance that doesn’t need an account.
The software is free open source. But this case is not about the software. It’s about the web instance that the majority of the people was using. And that instance now lost its privacy feature and shouldn’t call itself privacy friendly anymore.
What information is transmitted to GitHub when you sign in with your GitHub account?
I’ll tell you: that you signed into jitsi.
That’s it.
I agree with you and it’s an important distinction. But for me it’s also about the ethos of the developers or company. Promoting free and open source tools is great, but requiring the opposite as a prerequisite to use the largest publicly facing implementation of that is a very odd decision.
Is there another OAuth identity provider they should use? I agree that it’s ludicrous that advertising companies are the primary identity providers we use, but I have no issue with GitHub / Microsoft as an identity provider.
At the end of the day they could create their own account system and take on the liability of storing passwords, but why? That’s not what their software is about and as instance admins it will take away their time and focus.
At the end of the day I think what you’re chafing against is not their fault but a fundamental problem with open source software at the moment, we have no system of decentralized identity verification, and identity verification is basically a necessary part of ensuring your system isn’t abused.
I’d personally prefer they didn’t implement any KYC-style identity verification at all in the first place, but it’s not my service or project and I’m not a paying customer, so my preference is largely irrelevant to them. But that said, I didn’t intend the comment to be damning, or even a particularly harsh criticism, just thought it wad an odd choice.
If what you are saying is accurate, and there aren’t better options, I at least understand that choice a bit more. If they feel they need an identity provider for whatever reason, they should obviously choose the one they feel best fits that need. And as others have noted, different servers and instances can be spun up or utilized. Users can choose to utlize whichever fits their needs best, or none if none of them fit.
Your other point is well taken though that it may be a gap in the marketplace. Sounds to me like a need waiting to be filled. I recall reading about some decentralized blockchain solutions for this sometime back, but do not recall the specifics. I haven’t followed along because it didn’t seem relevant to my personal or business needs at the time.
If anyone else knows of alternative options that may be better or more privacy friendly, I’d certainly be interested to hear about them. And would chip in funding for any good FOSS projects that might seek to solve this problem.
Or just remove that claim
Why would federated sign-in suddenly make them non-open source.
The comment to which I replied complained that they claim their service to be privacy friendly. They didn’t complain about the open source claim, and me neither.
@owiseedoubleyou
It’s more likely about OIDC and not “email”. In which case they could have included Gitlab I guess. Let’s give them a while, they’ll probably figure out a list, this sounds like “how can we cover largest amount of people while adding fewest providers”
@esaru