Comparing the security of online audiovisual chat/conferencing platforms

Factual Questions
1

Like many people, I have been trying out a range of platforms for hosting group meetings. I’ve tried Skype, Zoom, Google Hangouts, Discord, Twoseven.xyz, Netflix Party, WebEx, … that’s what I can think of

WebEx is a paid/professional platform, so not really available for my recreational purposes.

Netflix Party limits content to Netflix and has only text chat and no audio/video, so far as I can tell

Twoseven is good for sharing YouTube videos and chatting but I haven’t successfully been able to share other kinds of videos. Overall I like the way it works.

The few times I have tried to use Zoom it hasn’t worked, and there are all kinda of stories about security problems, although all I’ve really heard of is Zoom-bombing, and if that’s all that we are talking about, it wouldn’t be a big concern for me and my friend groups.

I have a group that meets on Discord and another that meets on Google Hangouts. I really am starting to like the way Discord works and am trying to get my Hangouts group to migrate over. It would be great to reduce the number of platforms I’m using.

But one of my members is very concerned about security in a general sense—she won’t even post her content to Google Drive/Docs. She just sent me a link to this Nee York Times article — https://www.nytimes.com/2020/04/15/technology/personaltech/virus-essential-tech.html

— with the note “ Please read this. Google hangouts is recommended for privacy.”

The article doesn’t even mention Discord and it doesn’t look to me like it’s endorsing Google hangouts as being uniquely secure. But before I make that argument to her, I was wondering what folks here could tell me about these platforms and their relative security issues.

Is Google Hangouts the best? One of the better? Better than Discord?

What are the most secure free platforms? What are we talking about when we say “security” in this context? What’s at risk?

Any facts, experiences, advice is welcome.

Short question: Is Google Hangouts more secure than Discord, and if so what does that mean?

2

Here is an article comparing Skype, Discord, Facetime, Google Hangouts, and Zoom.

There don’t seem to be any major negatives for any of them, except that Facetime is for Apple users only, and Discord might seem a bit less than professional in atmosphere.

It doesn’t seem to knock any of them for having major security problems

This article from last fall says that there’s a lot of criminal activity, and perhaps white nationalism happening on Discord —

Does anyone have a take on this? Have there been any updates on the situation on Discord?

3

In order to have any reasonable conversation about security, this needs to be established upfront: What is your threat model?

It’s impossible to use online evaluations to guide your decisions as the range of threats you realistically face are different from the ones commonly assumed in most discussions about security.

Are you journalists trying to keep secrets from a repressive regime? Are you healthcare workers who are sharing HIPAA data? Are you someone with a stalker ex who is trying to ruin your life? Or are you just some people who would prefer not to see dicks in their face during your weekly check ins?

Security involves a bunch of different tradeoffs and systems that are the “most secure” for one threat model are not necessarily secure for others.

4

We are friends engaging in recreational activities. We might exchange manuscripts we are working on, but they are our personal projects. We might also watch videos or listen to music together, or practice playing music. Nothing work or government related.

5

I use Skype heavily at work, and it works well…for Microsoft shops needing Outlook integration.

After seeing adoption of Zoom amongst my in-law youngsters, I signed up for a Pro account (meetings > 40 minutes), mainly so our HOA board could meet. At least on a Pro acocunt ($15/mo, IIRC), you have a lot of control over meeting settings, including the ability to share documents, share screens, etc.

At this point, I’d recommend it. People were easily joining my meetings, and using a wide variety of platforms. As long as you take reasonable precautions (such as: don’t post meeting links/passwords on FaceBook), I think it’s very good and stable.

6

Our college uses Zoom primarily, people can use Google Meet. Zoom is easiest to use, and we have had issues with Zoom bombing, but that happens when a student gives out a meeting code to someone outside the class.

The pro version of Zoom is certified HIPPA compliant, so it is secure. What had happened is that one of the participants recorded the session and put it online, but that has nothing to do with Zoom security.

7

The why do you care if the video chat platform you’re using is secure or not?

8

Because one of my friends cares and keeps asking questions. She won’t post he stuff to Google Docs for example.

9

Best thing with Zoom is to have the administrator allow people to enter. Otherwise, anyone can use it at any point.

For the corporate world, it’s workable. For personal it’s good but just enable a couple of the gates when scheduling

10

Then use Signal. It’s the messaging tool that Edward Snowden recommends so if it’s good enough for him, it should be good enough for you.

11

Thanks for the suggestion, but what I really would like is factual information of all the services and some idea of what the real security risks are or aren’t. I want to be able to address her fears factually and not have to choose a service based on ignorance.

12

There’s no factual, objective ranking of security. If there were, then security would be a lot easier problem. The risks to all of these services are esoteric and not remotely in the world of what you need to care about. Security is broken in ways that don’t fit easily into a checkbox style spreadsheet.

I’m still unclear as to what you actually want. Your goals are all totally incompatible with each other.

13

Signal is “widely considered the gold standard of secure encrypted messaging apps” and passed a rigorous security audit. It’s about the best you’re going to get, I don’t know what else you need to convince this person.

14

I want to be able to say for example that switching from Hangouts to Discord doesn’t represent any significant risk of whatever you might be concerned about, such as malware, theft of personal information, theft of your manuscripts, etc.

I want to know what risks are known for the various common services so far as is known by experts on a factual and objective level. So that rational decisions can be valanced among security concerns, features, ease of use etc.