Security in VNCtalk – and our question: Are you sure that your business messenger and video conferencing solutions keep your sensitive data confidential?
VNCtalk offers end-to-end encryption for utmost privacy and secrecy in your communication. To achieve this high level of security, we integrated OMEMO in VNCtalk. Encryption can be turned on and off, according to the organization’s requirements and necessities.
First things first: OMEMO means „OMEMO Multi-End Message and Object Encryption“. It is an encryption protocol, based on open standards and allows the secure synchronization of messages and objects (like images and other files) across multiple clients.
Before we go deeper into the topic, we‘d like to share some thoughts about the current situation in many companies.
Digitalization has made a giant leap!
The Covid-19 pandemic has forced even traditional companies to embrace working from home and virtual collaboration. Actually, many organizations introduced new collaboration software and new workflows “over night”. This often happened unplanned and at very short notice, as everyone had to keep teams connected and provide a necessary level of communication and collaboration to stay productive.
This worked fine for short term, as many organizations did not have time for extensive evaluations and were caught cold by completely new conditions of cooperation. But now it‘s time to shift the focus.
So, the tough question is (and some of you might not like to read this or might not want to answer this question):
Do you believe your business messenger / video conferencing solution keeps your confidential data secure?
“Do you REALLY know who might have or get access, even if data is encrypted end to end?” Decisions for many video conferencing tools in the past few months such as Microsoft Teams, Google Meet, Slack, Zoom or even WhatsApp, were made quickly and only had ONE consideration in focus:
Keep the business running with these temporary solutions during the severe crisis.
But now it’s time to check whether the confidential data your team members share via chat, group chat or in videoconferences is really safe. It‘s essential to look for scalable, open and secure software for communication and collaboration that ensures your organization sets highest priority on security without compromising deployment flexibility or usability in the long run.
Evaluate your scalable, secure collaboration solution options carefully!
Building digital resiliency and collaboration security is critical for ensuring long-term success for any organization. There are several great video conferencing and business messenger solutions available on the market today that can help achieve this. We previously shared a statement from the OSB Alliance about video conferencing solutions and their associated opportunities and risks in our blog post “Overcoming distances digitally sovereign“.
One of the main points of the OSB Alliance statement is:
Decision-makers in public administration, school and education systems, and in companies too, must become aware of essential product differences. It is essential to ensure that a “product choice that appears attractive in the short term does not put the organisation in question in a disadvantageous position in the medium term, for example, because security has not been assessed, data is not stored in a GDPR-compliant manner, or dependencies arise that have far-reaching consequences for other parts of the IT infrastructure.“
Therefore, when you are selecting business messenger and video conferencing tools for organizations, security must be one of the most important factors to consider upfront. Above all else, it’s important to keep your valuable internal data safe. Therefore, with any communication and collaboration software vendor or service provider must ensure that your data is well protected in any environment to prevent data leakage, especially when dealing with sensitive data.
The example of Zoom has shown that with proprietary software you have limited ability to verify statements regarding security features. This is another reason why the use of open source software is crucial for trustworthy communication! Open source code provides a greater level of assurance by enabling increased proactive risk detection and containment control – and, if necessary the software can be easily independently audited by an outside provider.
(Source: OSB Alliance)
How secure is VNCtalk?
VNCtalk is innovative and highly flexible chat and video conferencing software that is a product of VNClagoon, based on best-of-class open source technologies for large organizations.
VNCtalk enables secure and efficient communication via chat and video conferencing and helps you to keep control of your data with extensive features, high quality performance, and great usability. VNCtalk can be hosted in the datacenter of your choice or on premise within your own IT infrastructure.
VNCtalk includes an additional layer of security.
For an additional level of assurance, VNC added another layer of security by including OMEMO encryption for VNCtalk. OMEMO means “OMEMO Multi-End Message and Object Encryption“ and provides several advantages in comparison to OTP encryption. For example, it also works when one of the recipients is offline. The main advantage over other XMPP solutions like OTR and OpenPGP: OMEMO supports both: group chats and multiple devices.
How does OMEMO work in VNCtalk?
Each “contact” device has it’s own private key. The keys are not shared between different “contact” devices. Each “contact” device additionally has a public key, which is exchanged between devices. Once the exchange is done, a new temporary “shared” key is generated from the public and private key of both devices. The “shared” key is then used in the encryption / decryption communication flow. The public keys confirm the authenticity of the shared key. Every message is encrypted with a new derived key. Advantage: If a third party is able to hack a single message, it does not mean that it will be possible to decrypt other messages as well.
Additionally, OMEMO treats other devices of the current user in the same way as devices of different users. So the general approach is to maintain separate encrypted sessions with each device of each contact (as well as with each of your other devices).
The key points of OMEMO encryption are:
-
- The devices of both (or more) parties each have public and a private key(s).
- The public key is shared to the other party, the private key is not.
- Once the public keys are exchanged, a new, temporary “shared” key is generated based upon public keys and private keys of both (or more) devices.
- The shared key is used in the encryption / decryption flow.
- The public key confirms the authenticity of the shared key.
- Double encryption is used.
- The option to enable encryption for users can be turned on and off, according to the organization’s requirements and legal necessities.
- Secure message synchronization: Chats, group chats and multiple devices are supported.
- Enables offline delivery
- OMEMO uses the Double Ratchet Algorithm.
There is a good explanation video about the OMEMO workflow on Twitter, watch it here.
About OMEMO End to End Encryption for VNCtalk:
The combination of OMEMO encryption, transparent best-of-class open source components (no hidden blackboxes) and the possibility to determine the location and type of hosting is the reason why VNCtalk is one of the most secure messengers and video conferencing products on the market.
VNCtalk can be hosted either in your own datacenter, within your own IT infrastructure or in the (certified) data center of your choice. It is a powerful tool for fast and efficient communication via chat and live conferencing which sets highest priority on security without compromising on usability.
VNCtalk – efficient, secure, scalable, flexible.
VNCtalk is available as a full featured web client in your browser, as a desktop client (Windows, Mac, Linux) and as a VNCtalk app (Android and iOS). All these versions work with the same backend.
Detailed information about VNCtalk, further technical details, visual materials and the VNCtalk explanation video can be found on our VNClagoon Website, in our Release Notes, and in our VNCtalk Manual.
Interested in other aspects of business messaging and videoconferencing software? Please also read our latest blog posts:
How VNCtalk can improve e-Learning
VNCtalk Version 3 – Worlds ahead!
Get ready for the next generation: VNCTalk versions 3.0.2 and 3.0.3
Successful virtual collaboration – Our tips for video conferencing
Virtual collaboration – Part One: Successful virtual meetings
VNClagoon Apps – Efficient collaboration when working from home
Further information on all our products can be found at www.vnclagoon.com!
Would you like to learn more about VNCtalk?
Register on VNClagoon LIVE and test the reference implementation of our VNClagoon Communication and Collaboration Stack!
With all our products, the security of your data is our top priority. Keep important information where it belongs – in your company or organization!
VNCtalk is part of our VNClagoon Business Software Stack.
VNClagoon is the enterprise grade software stack for all of your communication and collaboration needs. At the same time your valuable data remains under your control – no black boxes and no hidden backdoors! VNClagoon is a real alternative to closed software from vendors such as Microsoft, with all the features and functionalities you expect from a modern communication and collaboration suite including a messenger, real-time communication, groupware, project & task management, and much more.
We are convinced that the future of business software will be open source. Therefore, our integrated VNClagoon stack is entirely based upon open standards.
Further information information about all our products can be found at: www.vnclagoon.com!