Security is one of the most important aspects of internet-based communications platforms. For Aircall, security means trust. Without sufficient security and an active commitment to protecting customer privacy, there can be no future for Aircall as a business.
Fortunately, this topic is already well covered by the underlying technologies used in the Aircall platform, particularly WebRTC.
WebRTC security
WebRTC is designed with security at its core.
When making a peer to peer connection, which accounts for over 80% of all Aircall calls (true after activation of TURN server support in Aircall), that connection is first negotiated with a central media server using an encrypted WebSocket connection.
This connection identifies the web customer involved in the call, whether they are calling out or receiving a call.
Very little information is sent.
The WebSocket connection can be considered similar to a secure web based transaction, such as one that might occur on an e commerce website.
Once the call is determined, the WebRTC engine within the browser negotiates the actual voice call with the media server.
An encrypted exchange is used, and the encryption key is never made publicly available, including to the Aircall application itself.
Once established, voice throughput is secured by SRTP (Secure Real Time Protocol) within the call data and DTLS (Datagram Transport Layer Security) for the actual packets that are sent.
At no point is there a way for anyone to intercept the call data between the caller or receiver using the browser and the media server.
WebRTC security with TURN
The remaining estimated 20% of browser calls (once TURN is switched on) using Aircall will use a TURN server.
TURN is a proxy technology that improves call connection success. Any connections that require TURN are not considered true peer to peer, since a middle layer is used. However, the same security measures described above are applied, so the connection from browser to TURN server is equivalent from a security perspective.
Additional consideration is needed for the call data that leaves the TURN server and goes to the media server.
In many scenarios this is not a problem, since the transported data is still encrypted using SRTP.
However, it is possible for data to be affected by a third party within the TURN server if that server is untrusted.
Note: Data should not be compromised without the encryption data sent in the signaling, so even data passing through a third party TURN server should be safe.
In Aircall’s situation:
TURN servers are known and trusted.
They are located alongside the media server counterpart within the same data center.
This greatly increases security and leaves no room for security vulnerabilities involving third parties.
Recent Zoom security concerns
Recent security issues with Zoom's platform have raised concerns regarding video and voice calling platforms.
The issue with such platforms is often related to the application layer logic of the system. In Zoom’s case, rumors have spread that users’ encryption keys have been passed to third parties, which has made their platform vulnerable.
With Aircall, this is not possible, since encryption is handled differently by the WebRTC engine itself. WebRTC is an open standard and is subject to scrutiny by everyone, unlike Zoom’s proprietary standard, which is not publicly known.
Zoom also uses an MCU (Multipoint Control Unit), which combines media data from many sources into a single stream before passing it to participating users. This same technology powers features such as dynamic backgrounds in participant video streams.
In this scenario:
The logic used to determine participants of a stream and which data is selectively forwarded to other users depends on Zoom’s application logic.
Such logic may be flawed, allowing uninvited users to intercept and view streams.
In contrast, Aircall has no such security issue, since:
Calls are always between two users.
Calls operate within known, uninterrupted parameters, as determined by open standards.
Is Aircall's media server a concern?
Given the concerns around Zoom, it is reasonable to ask whether the use of a media server in Aircall presents similar risks.
In Aircall’s case, the answer is no.
The media server used by Aircall is a transcoding server.
It converts web based Opus / G.711 data from a WebRTC connection to and from a G.711 PBX line connection.
Aside from transcoding, the media server is different from the TURN proxy server.
All logic around the call connection is secured between the two participants.
Aircall does not support conferencing.
There is no proprietary application logic that might expose calls to uninvited guests.
This ensures that all calls are solely between the two peers involved in the conversation.
Aircall Status
Help logging in