SECURITY 2 - SIGNALING 3 - Don’t log IP addresses

SECURITY 1 - INTRO 1 - Introduction

SECURITY 2 - SIGNALING 4 - Security of signaling traffic - user identifiers

SECURITY 2 - SIGNALING 5 - Security of signaling traffic - validation of required fields

SECURITY 3 - MEDIA 1 - Ephemeral passwords in TURN servers

SECURITY 3 - MEDIA 2 - Force TURN to hide users’ IP addresses

SECURITY 3 - MEDIA 3 - TURN servers run inside your firewall

SECURITY 4 - CLIENTS 1 - User authentication in case of guest-anonymous users

SECURITY 3 - MEDIA 6 - Limiting access for known media workloads

SECURITY 3 - MEDIA 8 - Gate access to media server APIs

SECURITY 3 - MEDIA 7 - Fuzzing media server traffic

SECURITY 4 - CLIENTS 5 - Refrain from writing your own proprietary security implementations

SECURITY 3 - MEDIA 5 - Use port 443 for running TURN and Media servers

SECURITY 4 - CLIENTS 6 - Keeping up to date with Electron releases

SECURITY 4 - CLIENTS 4 - Patch known security vulnerabilities

SECURITY 4 - CLIENTS 7 - Backporting security patches in Electron

SECURITY 4 - CLIENTS 2 - Require the use of up to date applications

SECURITY 5 - UX-UI 2 - Hard to guess room identifiers and URLs

SECURITY 5 - UX-UI 3 - Don’t use predictable URLs for assets

SECURITY 5 - UX-UI 4 - User’s room must always have the user present in meetings

SECURITY 3 - MEDIA 4 - Deciding IP and port ranges in advance

SECURITY 4 - CLIENTS 3 - Keep track of libwebrtc releases

SECURITY 5 - UX-UI 1 - Stricter access rules by default

SECURITY 5 - UX-UI 8 - Implications of speaking when muted detection

SECURITY 6 - E2EE 1 - Is your service considered E2EE

SECURITY 5 - UX-UI - 7 - Turn camera lights off when muting video

SECURITY 6 - E2EE 2 - E2EE in WebRTC with media servers

SECURITY 5 - UX-UI 6 - Don’t open the camera if the user joins a meeting without user action

SECURITY 5 - UX-UI 5 - Close camera and microphone access when a session ends

SECURITY 5 - UX-UI 10 - Show a recording indication when someone is recording the meeting

SECURITY 5 - UX-UI 9 - Link sharing and file sharing over chat

SECURITY 6 - E2EE 3 - Double ratchet and MLS

SECURITY 6 - E2EE 5 - Secure recording

SECURITY 6 - E2EE 4 - Security at rest

SECURITY 6 - E2EE 6 - Gateways to external systems

SECURITY-2 - SIGNALING-2 - Be extra cautious when optimizing call setup time

SECURITY-2 - SIGNALING-1 - Be cautious when implementing auto-answer