4 ms·

Stop using Skype. The NSA allegedly collects all Skype traffic anyways. Do you really want that? "The full capture of voice traffic began in February of 2011 f

Stop using Skype. The NSA allegedly collects all Skype traffic anyways. Do you really want that? "The full capture of voice traffic began in February of 2011 for “Skype in” and “Skype out” calls—calls between a Skype user and a land line or cellphone through a gateway to the public switched telephone network (PSTN), captured through warranted taps into Microsoft’s gateways. But in July of 2011, the NSA added the capability of capturing peer-to-peer Skype communications—meaning that the NSA gained the ability to capture peer-to-peer traffic and decrypt it using keys provided by Microsoft through the PRISM warrant request." http://arstechnica.com/tech-policy/2014/12/newly-published-nsa-documents-show-agency-could-grab-all-skype-traffic/ http://arstechnica.com/tech-policy/2014/12/newly-published-n...

dethos 11y ago
Yes, there are far better alternatives out there, so if we could stop using skype and switch to something else, would be a great move here. However, the network effect is strong with this one, so it is impractical to make the switch.
- pbhjpbhj 11y ago
  Indeed I originally used it because it was cross platform, buy in meant relatives are now trained and comfortable with it. Personally I like HTTPS://appear.in for voice chat but one needs the phonebook, voicemail, online-indicator and such parts for it all to work efficiently.
- Someone1234 11y ago
  > Yes, there are far better alternatives out there, so if we could stop using skype and switch to something else, would be a great move here. What? There are secure text-only clients, but voice/video/group video? Where is the more secure version of those? Or is this going to go down the road of "set up your own VoIP service" again? People always say there are tons of alternatives to Skype... Where are these alternatives and why aren't they popular?
  - Relys 11y ago
    Signal has a secure calling option but it isn't very robust and I've had issues with it.
  - niutech 11y ago
    There is Tox, Jitsi, Firefox Hello and other services based on Webrtc.
verbify 11y ago
I've given up on the NSA not reading my stuff. The NSA collects pretty much anything they can get their hands on. It's a losing battle. If there's something I don't want the NSA to know about, I use Tails.
- chris72205 11y ago
  > I've given up on the NSA not reading my stuff. This is a scary thought, and I realize I'm increasingly feeling the same way everyday.
- cookiecaper 11y ago
  >If there's something I don't want the NSA to know about, I use Tails. This is a nice thought, but probably not realistic for a variety of reasons. Perhaps most relevantly, I would expect that a large quantity of major Tor exit nodes are tapped by the NSA. I would also expect that most servers you talk to are either already tapped by NSA in one way or another or can be tapped by the NSA trivially if they decide they want to see what's happening.
  - bad_user 11y ago
    Tor is vulnerable to adversaries that monitor Tor exit nodes. But this assumes for such adversaries to also control the destination service. The attack is effective if the adversary is setting up its own fake websites and then luring users in (with child porn, etc.), correlating their traffic. But for hot services, like Gmail, even if the NSA has the potential to track Gmail's traffic, the noise and the false positives are too great. And for services outside of the US jurisdiction, the NSA isn't able to legally coerce companies into giving them the keys needed for mass surveillance. Sure, they can reach agreements with local intelligence agencies for wiretapping and exchanging of information, but it would be an international disaster if it got out that foreign companies were forced through legal means by an US agency to hand over control. And this extends somewhat even to US-hosted servers of foreign companies. Yes they have physical access to US-based servers, no, it's not necessarily easy for them. What this means is that the NSA is not able to control and measure many popular Internet services. It's also all a matter of cost. Raise the cost significantly and it will get too expensive to do mass-surveillance, even for the NSA. Of course, if they target you directly, then all bets are off. Though in such a case they can just wiretap your home and office and hear everything you do or speak. But in the meantime if I use apps like Signal for communications, or PGP for my very private email, or SSL for connecting to my web server, I can be sure that the NSA is not tracking me because I'm not a target, I'm not a US citizen, I'm not interesting and it's probably expensive for them to track me through those channels.
gambiting 11y ago
I've actually had skype deployed in multiple locations as a way to do super cheap monitoring solution. 1) old laptops from ebay(probably paid $100 for each) 2) microsoft 3000 webcam 3) linux. Each laptop was configured with its own skype account, would start it on boot, audio out completely disabled, and set to pick up calls from friends automatically. Why not use a regular CCTV solution? I knew I could call that skype client from anywhere in the world, even from my phone, and I would get very good quality sound and video. I've had "networked" CCTV cameras which were $1000+ and they had choppy video and barely audible audio, plus you had to do some sort of dyndns solution to access them everywhere.
- ikurei 11y ago
  What kind of monitoring are you talking about, if I may? That solution, unless you haven't told the whole story, doens't record anything, so unless I'm watching closely just when they're robbing my hose it will be all for naught.
  - gambiting 11y ago
    It's not recording, you are correct :-) It was mostly to have a live preview from few locations, accessible anywhere, with sound. It wasn't used to stop thieves :-)

dethos 11y ago

Yes, there are far better alternatives out there, so if we could stop using skype and switch to something else, would be a great move here. However, the network effect is strong with this one, so it is impractical to make the switch.

pbhjpbhj 11y ago
Indeed I originally used it because it was cross platform, buy in meant relatives are now trained and comfortable with it. Personally I like HTTPS://appear.in for voice chat but one needs the phonebook, voicemail, online-indicator and such parts for it all to work efficiently.
Someone1234 11y ago
> Yes, there are far better alternatives out there, so if we could stop using skype and switch to something else, would be a great move here. What? There are secure text-only clients, but voice/video/group video? Where is the more secure version of those? Or is this going to go down the road of "set up your own VoIP service" again? People always say there are tons of alternatives to Skype... Where are these alternatives and why aren't they popular?
- Relys 11y ago
  Signal has a secure calling option but it isn't very robust and I've had issues with it.
- niutech 11y ago
  There is Tox, Jitsi, Firefox Hello and other services based on Webrtc.

verbify 11y ago

I've given up on the NSA not reading my stuff. The NSA collects pretty much anything they can get their hands on. It's a losing battle. If there's something I don't want the NSA to know about, I use Tails.

chris72205 11y ago
> I've given up on the NSA not reading my stuff. This is a scary thought, and I realize I'm increasingly feeling the same way everyday.
cookiecaper 11y ago
>If there's something I don't want the NSA to know about, I use Tails. This is a nice thought, but probably not realistic for a variety of reasons. Perhaps most relevantly, I would expect that a large quantity of major Tor exit nodes are tapped by the NSA. I would also expect that most servers you talk to are either already tapped by NSA in one way or another or can be tapped by the NSA trivially if they decide they want to see what's happening.
- bad_user 11y ago
  Tor is vulnerable to adversaries that monitor Tor exit nodes. But this assumes for such adversaries to also control the destination service. The attack is effective if the adversary is setting up its own fake websites and then luring users in (with child porn, etc.), correlating their traffic. But for hot services, like Gmail, even if the NSA has the potential to track Gmail's traffic, the noise and the false positives are too great. And for services outside of the US jurisdiction, the NSA isn't able to legally coerce companies into giving them the keys needed for mass surveillance. Sure, they can reach agreements with local intelligence agencies for wiretapping and exchanging of information, but it would be an international disaster if it got out that foreign companies were forced through legal means by an US agency to hand over control. And this extends somewhat even to US-hosted servers of foreign companies. Yes they have physical access to US-based servers, no, it's not necessarily easy for them. What this means is that the NSA is not able to control and measure many popular Internet services. It's also all a matter of cost. Raise the cost significantly and it will get too expensive to do mass-surveillance, even for the NSA. Of course, if they target you directly, then all bets are off. Though in such a case they can just wiretap your home and office and hear everything you do or speak. But in the meantime if I use apps like Signal for communications, or PGP for my very private email, or SSL for connecting to my web server, I can be sure that the NSA is not tracking me because I'm not a target, I'm not a US citizen, I'm not interesting and it's probably expensive for them to track me through those channels.

gambiting 11y ago

I've actually had skype deployed in multiple locations as a way to do super cheap monitoring solution. 1) old laptops from ebay(probably paid $100 for each) 2) microsoft 3000 webcam 3) linux. Each laptop was configured with its own skype account, would start it on boot, audio out completely disabled, and set to pick up calls from friends automatically. Why not use a regular CCTV solution? I knew I could call that skype client from anywhere in the world, even from my phone, and I would get very good quality sound and video. I've had "networked" CCTV cameras which were $1000+ and they had choppy video and barely audible audio, plus you had to do some sort of dyndns solution to access them everywhere.

ikurei 11y ago
What kind of monitoring are you talking about, if I may? That solution, unless you haven't told the whole story, doens't record anything, so unless I'm watching closely just when they're robbing my hose it will be all for naught.
- gambiting 11y ago
  It's not recording, you are correct :-) It was mostly to have a live preview from few locations, accessible anywhere, with sound. It wasn't used to stop thieves :-)