11

Is it possible for a Mumble server operator to monitor or record users' conversations? Or are Mumble conversations encrypted end-to-end?

Improve this question

2 Answers 2

Reset to default
13

Mumble's home page states it uses public-key cryptography. This is done by using the TLS protocol, which is mentioned in the FAQ.

With public-key cryptography, the private key is always known by the server. Thus, a Mumble server administrator indeed has access to the private key - usually in the form of a X.509 certificate - which can be used to decrypt the TLS handshake to derive a session's symmetric cipher key. This key is used to encrypt and decrypt all data transmitted over the connection. In other words, an administrator certainly is capable of decrypting all traffic.

Also, nothing stops a server administrator to log and record communication on the server.

Improve this answer
2
  • 3
    Note that Mumble servers being able to read/view your stream has nothing to do with using public-key cryptography and everything to do with the protocols being used. They decided to just encrypt the communication to and from the server (which I consider reasonable, given how you can just host your own server). If they decided to add end-to-end encryption they would still use public-key cryptography, as it is a necessary building block of basically every protocol that does not rely on a pre-shared secret (and those are bad for usability).
    – Perseids
    Jan 29, 2015 at 20:53
  • 1
    Only old crappy SSL implementations let you decrypt the handshake with the private key. Any modern handshake should use Diffie-Hellman. A Mumble server knows the session key of course. And the serer's private key would let you MITM the handshake.
    – Jeff Burdges
    Apr 4, 2015 at 12:05
2

Adding to Stevens correct answer: http://mumble.sourceforge.net/FAQ#Is_Mumble_encrypted.3F chat is indeed TLS encrypted and voip via OCB-AES but both channels are only server-client as opposed to end-to-end, i.e. the server (operator) has in principle access to all clear text and voice running through the server.

Hence I run my own server (setup is really easy), see http://mumble.sourceforge.net/Running_Murmur

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .