8 ms·
How Skype fixes security vulnerabilities
- illuminated 10y agoSadly, Skype is still used a lot. More than half of the emails I receive with a next step of communication proposal come suggesting Skype. The only way to beat it would be to have another communication solution which can be used as simple as Skype is (for any age, technical literacy, etc.).
- sebisebi 10y agoI got a lot of friends to switch to whatsapp. The audio quality and stability is usually better.
- cm2187 10y agoOn a desktop?
- Angostura 10y agoAnd it requires uploading every contact on your device to their servers. Nope.
- tokenizerrr 10y agoHow do you use whatsapp from a laptop without signing up using a phone first? Doesn't seem convenient at all.
- iopq 10y agoA lot of people use Discord now. I mean, you can use it inside of a browser, what can be easier than that?
- egeozcan 10y agoSeems to be designed for games only, or did I end up in a targeted landing page?
- jhgg 10y agoGames are the target niche - but really - anyone can use it. At the end of the day - it's just a chat product - that has some gamer centric features.
- iopq 10y agoIt's for gamers, but it's just chat and voice. I think it's smart of them to capture a niche because they have integration with streaming to Twitch. For example, it hides the names of contacts/server invites when you're streaming video online.
- davidgerard 10y agoMy mother literally got broadband to Skype with her grandchildren.
- calsy 10y agoliterally?
- lsh 10y agono, just metaphorically.
- grundprinzip 10y agoJohn McWhorter: Words on the Move: Why English Won't - and Can't - Sit Still (Like, Literally)
- davidgerard 10y agoLiterally. That was the use case.
- robert_foss 10y agohttp://appear.in/yourconferencename http://appear.in/yourconferencename is rather convenient and should be usable by anyone with a browser.
- alkonaut 10y agoThis. People talk about various alternatives, but I haven't seen one. The requirements are pretty simple 1) Chat and group chat (persistent) 2) Simple file transfer and image posting in chat 3) Good quality voice calls, video calls and group voice calls 4) Apps for android/iOS with shared contact lists 5) Single application for all of the above (to enable a single group set, switching between group chat and group call with one button) 6) No server setup 7) Free or freemium on all platforms (With all features 1-5 in the free tier) Are there any good alternatives? Is there even an alternative?
- waldfee 10y ago+ screen sharing
- tluyben2 10y ago3) Is not true for me though, it's awful mostly, but that's my pet peeve (all coders assume everyone else is on a 1000mbit connection as well all the time) and MS is really bad at making anything work on bad connections. Office 365 isn't even getting past the 'wait while loading' while Google drive/docs is completely usable when I have a bad connection (which is often). The software that was written for bad connections, like Whatsapp and Wechat, for me, have much better quality. But no video (which I personally don't need, but it violates your 3rd demand).
- londons_explore 10y ago
- kagamine 10y agoI started using Pidgin with the Skype plugin, because the company I work for uses Skype for Business (Lync in other words) and that program doesn't log anything, and in business logging is vital. Pidgin is open source, as are all the plugins, making it a good choice for business knowing you aren't installing anything you should not be, and it handles files etc ok, but doesn't do video at all.
- TorKlingberg 10y agoWebRTC is almost there, and I think in the next few years most such emails will have a link to a WebRTC based service. It is easier than Skype really. Just click a link and it starts a video call. There are jsut a few browser compatibility issues that need sorting out.
- walrus01 10y agoI wonder how many other free services' accounts can be disabled by bombarding an automated abuse-reporting/blocking system with reports of "abuse" from a specified username. A lot more than just Skype, I bet. And many of these services have no method of contacting a human at "customer service" because of the sheer number of free accounts (tens of millions).
- azernik 10y agoThere have been a lot of instances of this happening to feminist or LGBT groups on Facebook and YouTube. These systems are fantastically abusable.
- walrus01 10y agoIf I were setting up an automated abuse-report-receiving system that could automatically disable accounts, I would run some sort of filter for "is the account reporting the abuse itself a newly created account, and/or one with suspiciously low and non-human looking usage patterns?". But on the other side, malicious actors can solve that problem by having clickfarm workers in bangladesh create 30 fake facebook accounts, post random drivel on them for a week to make them look like they're in use, and then use those to report abuse.
- londons_explore 10y agoOne can require the account before many years old before having much weighting. Also, require verified phone number by sms or a verified non prepaid credit card. Allow the user to use your site without that stuff, but restrict actions that spammers like to requiring it.
- zdkl 10y agoRequiring phone number or credit card is an extremely effective way to have a large class of (legitimate) users nope out of your service
- tomp 10y ago> <Skype> > We think that we gave enough information. You are piece of shit, live with it. I've no idea if this is real or not, but if it is, it's pretty damning for Microsoft. I hope the author goes to court and wins!
- grzm 10y agoFrom the article: "Short recap:" As far as I can tell this recap is a summary of the original email exchange which is available from a link in the article. http://telegra.ph/SRX1365288845ID---Account-blocked-by-mass-abuse-reporting-12-19 http://telegra.ph/SRX1365288845ID---Account-blocked-by-mass-... I haven't read it closely enough to confirm that the gist of each message corresponds, but I don't see any of the explicit, abusive language from Skype in the emails that shows up in the recap.
- egeozcan 10y agoThat is how the author sarcastically summarized the canned messages sent by Skype. Not very far from the truth, however.
- custo15 10y agoThe original article is in Russian, and here for our mentality this is not such unacceptable sarcastic exaggeration. But it may be too strong for a Western reader. So this can be considered as a little translation glitch (IMO).
- bad_user 10y agoLast week Skype dropped 2/3 of my contacts list. I contacted their chat support to tell them about it. The person on the other end was insisting that I might be using another Skype account where my other contacts are. Which of course I ain't since I'm not that stupid. He then suggested the stupid bullshit Tier 1 support usually does, like reinstalling Skype. I did as asked. Then he asked me for remote control of my PC which I refused, because I have sensitive data on my laptop and I'm on a MacOS anyway. I then asked for my issue to be upgraded to a higher-level tier, because losing my contacts is unacceptable. Then he made an accusation that I haven't reinstalled Skype as asked and that I'm probably using two accounts, at which point I gave up. Anyway, Skype sucks, it's been a week since I've lost most of my contacts which I've been collecting for about 7 years or so and their support is useless. If you're relying on Skype for your business, stop doing that ;-)
- pawadu 10y agoThe support guy sure sounds like an ass... With that said, is your Skype account linked to a Microsoft live account? In that case thats were your contacts should be now.
- bad_user 10y agoMy account is connected to a Microsoft account, but I can no longer authenticate with my Skype credentials, I can only connect with my Microsoft account now. But it's the same account, the Skype ID is still there. Or in other words, if I indicate my Skype ID as the username in the auth dialog, they now expect my Microsoft password, not my old Skype password (I have unique passwords everywhere). If you have any idea of how I can get my accounts back (I'm not interested in getting the connections back, just the list of IDs, because I don't remember everyone) that would be great.
- pmelendez 10y agoIf you are using a Microsoft account, have you try to see if your contacts appears on outlook.com? They should share the same contacts
- noelwelsh 10y agoMost interesting to me was the response from the MS Security Response Centre: "[T]his is not a valid vulnerability ... [It] relies entirely on social engineering." This narrow view of what constitutes the system shows that MS Security is seriously flawed. If you run hosted software you have to consider the security aspects of the total system, including support and other human factors. Seems like MS is stuck in the mindset of shrink-wrapped software.
- viraptor 10y agoI feel like this could be fixed very quickly if someone wanted to invest the time and was a bit on the chaotic side. 1) find Skype IDs of Microsoft managers, known people, big businesses with ties to MS 2) create 20+ fake accounts 3) start reporting abuse... It's the same issue as in any big system - people on high enough positions are isolated from all the crap normal users have to deal with. If you can interrupt their business call though... I expect the fix will be coming soon.
- therein 10y agoThis is very true. OP can contact me for some MS employee Skype usernames. :)
- marksamman 10y agoI've been looking for a Skype alternative since the security of Skype was weakened after it was acquired by Microsoft. I've had my account stolen multiple times because their support has changed the primary e-mail address of my account, I had to use the same method the social engineers used to get my account back. Since then I've avoided sharing anything slightly sensitive over Skype, as chat history is synced with anyone who accesses your account. Finding a replacement isn't easy, but I've used Wire (wire.com) for a year now and find it good enough feature-wise, and excellent security-wise. It has its quirks and can be a resource hog at times (the desktop app uses Electron IIRC), but it's worth switching from the security disaster that is Skype.
- noja 10y agoWhy don't you try Jitsi? https://jitsi.org/ https://jitsi.org/
- marksamman 10y agoI just had a look at Jitsi and it seems like the Android app is in alpha stage, and that there won't be any iOS app (https://jitsi.org/Documentation/FAQ#ios https://jitsi.org/Documentation/FAQ#ios). Smartphone apps are important to convince my contacts to make the switch, and to be able to communicate with them over the same channel when they're away from the computer.
- raphaelh 10y agoYou can also try https://meet.jit.si/ https://meet.jit.si/ Works directly in the browser (thanks to WebRTC), nothing to install, no need to create an accound. There's group video chat, screen sharing, youtube video sharing, collaborative text editing,... And it's free software :)
- blunte 10y agoI too switched from Skype to Wire, but it has been a challenge to convince other people to move to Wire. It has further been frustrating that it almost seems like the people running Wire have been trying to avoid marketing or letting people know that Wire exists. That makes me wonder about their long term intentions (and if I'll lose credibility with my contacts that finally migrate to Wire just before wire vanishes or gets bought out by Facebook or Microsoft...)
- aleksi 10y agoOriginal in Russian: https://habrahabr.ru/post/316912/ https://habrahabr.ru/post/316912/ Original submission by author: https://news.ycombinator.com/item?id=13225939 https://news.ycombinator.com/item?id=13225939
- wslh 10y agoIt is obvious for me that Satya Nadella never uses Skype (or Lync, cough cough, Skype for Business). If he were using Skype he would write an e-mail like this Bill Gates rant: http://blog.seattlepi.com/microsoft/2008/06/24/full-text-an-epic-bill-gates-e-mail-rant/ http://blog.seattlepi.com/microsoft/2008/06/24/full-text-an-... about Movie Maker.
- wwwigham 10y agoI don't think I can fault Skype for this "vulnerability" - the problem itself isn't really in code, but in people. Yes, within the article there's mention of a past attack which relied on socially engineering a support specialist to send verification codes and guess the result, but that seems to have stopped. I'd actually love to know the key generation algorithm or the probabilities that go into guessing one of four-ish codes sent in a burst in just a few tries. Still. the other exploit mentioned, the one not "patched" - This same kind of mass-reporting system exploit is usable in all manner of online forums and services - heck, HN's own flag feature could get pretty close (we just have some very hands-on moderators and an okay community)! As for not restoring something when contacting support... I can understand why. It's _better_ this way, since then no malicious party who is _actually_ spamming with Skype accounts can retrieve an account using only a bit of social engineering! Instead they need to roll up new emails and new accounts. (And think of it this way: If a malicious party is abusing the system to get your account blocked, how will they know your new account to repeat the procedure? They shouldn't.) Yes. It's a pity that the abuse reporting system is itself vulnerable to abuse, but... aren't most? Given Skype's massive userbase, putting the user reporting function behind a mechanical turk... the rate at which they'd need to comb through ban requests would seem to make fatigue (and thereby false positives which would result in the same outcome as now) inevitable. The only interesting way I've seen this abuse-system abuse handled in recent years was the League of Legends tribunal system[1], where they effectively handed penalty decisions to the community at large and let them come to a consensus. Though I don't know how well it worked and, honestly, that system seems just as game-able as the automated report button itself. In fact, it feels analogous to a Sybil attack[2] in the crypto world - get enough aligned malicious identities in a decentralized system and they effectively control it. The only "fix" is making identity creation too expensive to make gaining a controlling share of the identity-space prohibitive (which would entail making account creation difficult) - I feel that this is _directly at odds_ with account creation speed and this user acquisition for a service like this, so I can not fault Skype for falling on the middleground that they have. [1]http://forums.na.leagueoflegends.com/board/showthread.php?t=2068259 http://forums.na.leagueoflegends.com/board/showthread.php?t=... [2]https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack
- Dylan16807 10y ago
- klausjensen 10y agoSkype makes me sad. I used it 10 years ago, and it was great - or at least pretty good, compared to the other options. Video calls, screen sharing, chat. But it had a number of problems. Mostly surrounding using it on multiple devices, making it very hard to keep track of what has and has not been read. Log onto Skype on a device I have not used in a couple of days, and "unread" messages show up - messages I have already read. Over the past 10 years, none of the issues that I care about have been addressed. But we did get some garbage integration with facebook and nice emoticons. They added features nobody wants and have not addressed the problems. It is maddening. It makes me sad. But it is unfortunately still the standard when you deal with non-technical people, so I keep using it... :(
- toyg 10y ago> making it very hard to keep track of what has and has not been read This seems to have finally been addressed, at least on my OSX/iOS combo.
- jokoon 10y agoI recently had an interview on Skype. I added the interviewer in my contact list, but we were never able to start a video conference. We did it by phone instead. I did not have the job. Thanks Skype. Not to mention the interviewer had Skype Pro. Not to mention the intrusive ads.
- Aissen 10y agoFrom my sources inside of Skype, everyone is leaving, and Microsoft might be preparing to sell it. No wonder that nothing's changing.
- gst 10y agoThis would explain why they don't allow anymore to link your Skype to your Microsoft account: https://support.skype.com/en/faq/FA12060/can-i-link-or-unlink-my-skype-and-microsoft-accounts https://support.skype.com/en/faq/FA12060/can-i-link-or-unlin...
- dirtbox 10y agoLast year I discovered a bug that allowed you to call someone's phone and remotely activate it's camera and mic by disconnecting the call while it was ringing - the target's device would simply call you back as if it were a dropped call. They fixed it, but boy that was a doozy.
- dirtbox 10y agoOh god, haha! Someone picked up my original post about it on reddit and wrote an article including my original drawing. http://www.androidpolice.com/2014/12/22/security-hole-skype-allows-users-surreptitiously-connect-users/ http://www.androidpolice.com/2014/12/22/security-hole-skype-... Ed: Oh my word, hundreds of phone, tech and malware blogs picked up on it all over the world. I didn't have a clue.
- zhovner 10y agoWow! Looks pretty the same to remote mic activation on desktop that i found few years ago https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=https%3A%2F%2Fhabrahabr.ru%2Fpost%2F133555%2F https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=h... Skype for Android can receive a call when skype app in backgroud?
- rasjani 10y agoLync (Skype for business) has been The Worst support that I've ever dealt with.
- andybak 10y agoMods removed "(They don't)" or similar from the title. Before they did this I think it more accurately reflected the intent of the original author as this is the prominent subtitle on the page. Without this it makes the article sounds much less interesting.
- bryanrasmussen 10y agoWhen I read the title without the They don't in it I thought sarcastically to myself "They don't".
- TeMPOraL 10y agoI literally did the same when I read the title. I guess Skype has done a lot to earn the snark.
- s_kilk 10y agoWhat is the deal with the low-quality title editing on here? So often we see good, informative titles get mindlessly edited to match the `<title>` tag of the target page.
- edpichler 10y agoI use Skype for more than 10 years, and I feel it's abandoned. I also have a Google Voice account, same feeling.
- sprite 10y agoMy account on Skype seems to have gotten some sort of shadowban. I don't show up when people search for me and when I send people a contact request it shows as sent on my side but the other person never receives it. I can communicate fine with my existing contacts.
- anocendi 10y agoMy first reaction seeing the title was, "Is this for Real!?". Then, I saw what I was expecting as the very first line in the article.
- 120bits 10y ago> Skype tech support is vulnerable to social engineering, and Microsoft is perfectly OK with that. This is bothers me alot. My mom got a call from this guy pretending to be MS employee couple of weeks ago. He told her that the PC has been infected by virus and MS has been notified and he is helping her to resolve the issue. For a person like my mom who is not much of tech savy person, the chances are really high to fall for this. Fortunately, she told that guy to call her back later, because she didn't know the administrator password.