Brave, the privacy friendly web browser, has made available a trial version of its new video calling service: Brave Together. We’ve been using it the past week for our calls.
Who is Brave?
Brave is an alternative web browser, with a mission to “fix the web by giving users a safer, faster and better browsing experience”. In short, it is challenging mainstream browsers by protecting users’ privacy. It also gives users greater control over what they see and rewards them for interaction with content.
Brave was founded by Brendan Eich and Brian Bondy. From a privacy perspective, it has been nurtured under its well-regarded Chief Policy Officer, Johnny Ryan. With a formidable team, they have created a product that does what it says on the tin. And they are positively responsive to issues with their product that conflict with the mission. Already Brave has over 14 million users, including Impact Privacy.
Brave Together
Currently on trial in its Nightly Version, Brave Together (www.together.brave.com) is built on Jitsi, a well-established open-source, secure video conferencing platform. That begs the question: what is new about Brave Together?
Well, we think the grab is simple: a browser-based video conferencing facility by a provider that places privacy and security at the heart of its business. That puts it ahead of any number of existing facilities that, arguably, have been reactive rather than proactive when it comes to privacy and security. Brave’s timing means it can also learn from mistakes others have made.
So how does Brave Together stand up?
Security
The Basics
Each meeting is hosted in a unique room created when the first person joins and deleted once the meeting ends. This helps prevent attackers target rooms.
Jitsi acknowledges that many users like to create rooms with names that are relevant to the meeting. They facilitate this but are working on a “bad name detector” to help users avoid conflicts and the risk of targeted attack. That will be helpful.
Critically, hosts can set a password for the meeting. This password has to be communicated to participants separately (and the secret does not pass through the Jitsi servers, see below).
Encryption
In 1-to-1 meetings, Jitsi uses peer-to-peer encryption under the DTLS-SRTP framework.
However, for multiparty meetings data packets traverse the Jitsi Videobridge, again using DTLS-SRTP. Because Jitsi is built on WebRTC, this means data packets are decrypted through the Videobridge (albeit it has no persistent storage).
On the face of it this does not look like true end-to-end encryption. But, with strong password protection (see above), any residual risks should be significantly reduced. If you want to know more about the WebRTC security architecture, you can find it here: https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-20
Recordings
Recordings will always be a problem when stored on the servers of the provider. Recording is not available on Brave Together (although Jitsi can be configured to stream to YouTube). If it becomes available, we would love to see the facility to record directly to the device.
Privacy
As privacy professionals, we always want transparency on how our personal data is used.
The great news is that the privacy information is front and centre on the Brave Together landing page.
Click, and it takes you to the top of the Brave Together section of the Brave Privacy Policy, which includes a link to additional data processing detail: https://brave.com/privacy/#brave-together. Brave say that personal data is processed only for the purpose of actually facilitating the call and to store a profile. As Brave Together is currently on the Nightly version of Brave it appears certain personal data is used to test the product and fix problems: service model, iOS version, language, timezone, CPU architecture, carrier, and connection status.
Overall, there was nothing of critical concern. However, whilst the privacy information is reasonably clear, it could be made more accessible through the greater use of icons and drop downs.
In Use
There’s not too much to say here. Because Brave Together is on a Jitsi platform, there is nothing novel about its functionality or UX. It is intuitive and easy to use, and it does what you need it to. The main features include:
- Auto-view the active speaker or click on any attendee to see their video
- Android and iOS apps
- Text chatting (web only)
- Lock a room with a password
- Screen sharing
- Shared text document based on Etherpad
- Raise/Lower your hand for attention
- Participant talk-time statistics
- Play a YouTube video to all attendees call
- Audio-only option
Brave Together can only be used on the Brave Browser. That can be a problem because with a relatively small number of users, you invariably have to get your participants to download and use Brave. For some this can be difficult, or simply not possible because of internal policy restrictions. On the flip side, the Brave Browser is generally much faster than other browsers, so connectivity is better.
There is also some functionality not available that may irritate some (for example, you can’t set your own background), and it is not yet entirely clear whether there are any limits to the number of users or the length of a call. However, we suspect this will get ironed out in time.
What we think
Right now, Brave Together is less about novel functionality, and much more about greater confidence around security and privacy. If that is important to you (and it should be), Brave Together is definitely worth investigating.
