Watch WebRTC Live #85: Implementing Gold Standard Privacy and Security for Video Applications – WebRTC.ventures

On November 9, 2023, Robert Strobl, CEO and Founder of Digital Samba, joined host Arin Sime on WebRTC Live to explore implementing gold standard privacy and security for video applications.

From the EU’s General Data Protection Regulation (GDPR), to HIPAA in the US and PIPEDA in Canada, to state laws like the California Privacy Rights Act (CPRA), it is clear that digital data privacy is a growing concern among lawmakers. Gartner expects that 75% of the global population will have its personal information covered under privacy regulations by the end of 2024. So, this is an important topic for developers and anyone offering or using video conferencing platforms today!

The conversation touched on these topics and more (links go to excellent resources on Digital Samba’s site):

Data Privacy in Video Applications

• The unique aspects of video applications where we need to consider data privacy compliance
• The importance of GDPR compliance in Europe
• The EU-US Transatlantic Transfer Data Agreement
• Overlap with the regulatory practices of HIPAA in the US and PIPEDA in the Canada, among others

Data Security and E2EE Encryption in Video Applications

End-to-End Encryption (E2EE) is a method employed by Digital Samba to ensure secure and private communication during group video calls. Robert shared how and why Digital Samba implements E2EE and lessons learned in this implementation. He also shared potential downsides of E2EE, which must be weighed against the benefits of E2EE to determine the most appropriate approach to data security, including:

• Complex Application Flows: Incorporating E2EE often requires significant changes to the existing architecture
• Resource Consumption: Increases computational and memory demands.
• Key Management Challenges: Introduces complexities in cryptographic key handling.
• Feature Limitations: Inhibits server-based features like closed captioning and recordings.
• Server-Side Recordings: E2EE also prevents server-side recording of communications
• Difficulty in Implementing Legal Compliance: Conflicts with laws requiring data access for legal oversight.
• Troubleshooting: Complicates diagnostics and error resolution.
• User Experience: Affects functionalities like message search and multi-device syncing.
• Costs: Raises infrastructure and development expenses.

Robert and Arin also touched on the future of security in WebRTC, including how it is affected by AI-enabled features. 

Watch Episode 85!

Up Next! WebRTC Live Episode 86
WebRTC Live Streaming: The NeverEnding Hack

Wednesday, December 6 at 12:30 pm Eastern

Register.