4 ms·

Why Skype is Evil (2007)

50 points by rl1987 15y ago

rubyrescue 15y ago
i spent a half hour reading that skype reverse engineering pdf a week ago and just for kicks took a look at http://en.wikipedia.org/wiki/Skype_protocol http://en.wikipedia.org/wiki/Skype_protocol and it doesn't appear to me that the private keys are shared nor that they're generated in an insecure manner... so how would skype be eavesdropping? the article makes the case that skype is evil due to an intentionally weak protocol but doesn't back it up with a technical argument as to what's wrong with it. i'm not defending skype, just confused.
mfjordvald 15y ago
This was posted in 2007, worth keeping in mind before jumping to conclusions.
- crocowhile 15y ago
  Well, the main message still holds true though: if you need to make sure nobody can eavesdrop your communications, you'd better off with open source software.
  - weego 15y ago
    As long as you understand the code line by line and as an overall entity, otherwise you are no better off. Just because you can read the source doesn't mean you actually can.
    - lucasjung 15y ago
      With open source, the chances that somebody will catch a security flaw are generally much higher. It's not necessary for each individual user to understand the code as long as some people do.
    - crocowhile 15y ago
      I am not the only human being on this planet, you know (And if I were I would not need skype anyway).
    - vabole 15y ago
      Even if you can not read and understand the code you are still better off with the open source. Due to the fact that independent researchers or programmers unaffiliated with developers will be able to audit the code. While with the closed source software, the only information you have about the inner workings of the software is provided by the developing company.
  - slavak 15y ago
    Not that that guarantees anything, of course... http://c2.com/cgi/wiki?TheKenThompsonHack http://c2.com/cgi/wiki?TheKenThompsonHack If you need to _make sure_ nobody can eavesdrop on your communications, you better be ready to design and manufacture all hardware and software you're using yourself.
    - crocowhile 15y ago
      I wouldn't be so extreme. It's reasonable to assume that a properly encrypted connection is secure form entry to exit. You would have to use proprietary tools only at the extremities then, which is actually quite feasible nowadays. anyway: after learning that not even Osama wasn't even encrypting his shit my view on security is slightly different.
nextparadigms 15y ago
I wonder if this has anything to do with that "bug" that gives root access to Macs.
muuh-gnu 15y ago
I'm so tired of articles how bad/evil/insecure Skype is, while not suggesting any usable alternative. Skype, whether you like it or not, has no viable competition, almost 8 years after its initial release. By "usable" I have the following requirements in mind: * Cross platform: It has to offer clients for Linux, Win, OSX. * It has to support voice and video. * Easy to install: Even grandparents in Australia have to bee able to install it. No NAT and other configuration bullshit, just enter a name, a password and ready to go. Skype has helped connect my all over the world scattered family for more than half a decade now. I am absolutely willing to give up any kind of privacy and security in order to be able to video-phone my family living thousands of miles apart whenever I want at absolutely no cost. No, absolutely no free software system has yet been able to provide the above 3 minimum requirements for me to consider ever leaving skype. P.S. Thanks for the immediate downvotes.
- gniv 15y ago
  http://www.google.com/chat/video http://www.google.com/chat/video
  - muuh-gnu 15y ago
    No free software. Theres no point in replacing one closed system by another, especially when the first one works much better. Googles system is only accessible through Gmail, is very awkward to use and has the "irrelevant addon" feel. Had Google _ever_ intended to offer widescale Voice&Video, they'd have built video into Gtalk when they had the chance.
    - sabat 15y ago
      Actually, Google's video/audio calls work in the browser. Not only is the software free, but you already have it.
      - codeup 15y ago
        You mean that only the browser is software, but not what runs in the browser?
sigzero 15y ago
If we continue to label everything "Evil" when it is clearly not the word will lose its meaning.
nck4222 15y ago
"Do I know that NSA helped fund eBay’s purchase of Skype? No, I certainly do not." It then links to an April Fools article (http://www.oreillynet.com/etel/blog/2007/04/skype_revenue_from_national_se_1.html http://www.oreillynet.com/etel/blog/2007/04/skype_revenue_fr...) to help support that there's a link between the NSA and Ebay anyway. EDIT: Maybe I missed the joke, since the name of the blog is ultra paranoid, but that article was garbage.
nikcub 15y ago
Article is from 2007 and most of it turned out to not be true . When Skype is served a subpoena, they can only return account information, they are unable to intercept or log voice or video calls[1] [2]. This is a big deal in China and Russia[3] where they block the service since they have no way of intercepting it (ie. it is secure enough for two very large governments to have no way of dealing with it). Further proof is that there are no publicly known cases where skype call or chat logs have been submitted as evidence, while you see google, microsoft, ebay, craigslist etc. appear all the time. Skype is an independent company again - and the reason why eBay bought it back then is revenue ($850M pa last year), not some conspiracy theory outside of the odd client exploit, skype is safe. I would trust it if I was a dissident in an unfriendly foreign country and needed to communicate securely. [1] http://www.voiptechchat.com/tech/34/skype-says-no-to-wire-tapping/ http://www.voiptechchat.com/tech/34/skype-says-no-to-wire-ta... [2] http://news.cnet.com/8301-13578_3-9962106-38.html http://news.cnet.com/8301-13578_3-9962106-38.html - see skype only IM company that does not comply with wiretap requests [3] http://arstechnica.com/telecom/news/2009/07/russia-not-the-first-to-see-skype-as-a-security-threat.ars http://arstechnica.com/telecom/news/2009/07/russia-not-the-f...
- deleted 15y ago
  [deleted]
- horatiumocian 15y ago
  Indeed, the fact that Skype was spun off by Ebay, and is preparing for an IPO with close to $1Bn in revenue, contradicts a significant part of this conspiracy theory. Although, it still could be true.
- vabole 15y ago
  1. Skype is not blocked in Russia. Federal security officials voice their concerns about Skype every once in a while, which causes rumors about possible blockage in media. Although nothing came out of it yet. 2. In China all skype servers redirect to their Chinese partner http://skype.tom.com/ http://skype.tom.com/ Tom Skype has everything that you would expect in QQ or other Chinese IM's, namely intrusive ads and content filtering. There is research showing how much data is leaked by the Tom Skype and how insecurely it is stored. http://www.nartv.org/mirror/breachingtrust.pdf http://www.nartv.org/mirror/breachingtrust.pdf It is quite worrying that Skype has a such partner. Although it makes me think that Google would have more success in China if it found a Chinese partner like Tom Google.
trotsky 15y ago
The NSA (and FBI et al.) have a pretty workable solution for strong encryption on the wire - they attack the client. The client computer (or mobile) is pretty much full of holes, if someone wants in they'll get in, and sooner rather than later. Related, the Germans seemed to have commissioned a trojan to monitor skype and tls traffic on the endpoint: http://www.wired.com/threatlevel/2008/01/leaked-document/ http://www.wired.com/threatlevel/2008/01/leaked-document/ Somewhat related, the FBI routinely uses flaws to install CIPAV: http://www.wired.com/politics/law/news/2007/07/fbi_spyware http://www.wired.com/politics/law/news/2007/07/fbi_spyware Granted, none of this enables the wholesale monitoring of skype communications. Practically, even if the NSA had access to individual signing keys or some kind of side channel leakage it probably wouldn't be getting used en masse. The computation requirements of decrypting all traffic are likely significant, and operational security would discourage the wide use of a closely held leakage bug in fear of disclosure like happened with the domestic wiretapping scandal. As an aside, I found it quite amusing to read "For example, a person in Germany, talking to a person in Russia using land-line phones would previously have been out of reach for NSA" - ultraparanoid? Pshaw.
dspillett 15y ago
The word "evil" if much overused these days. Slipping a little of topic: my main reason for distrusting Skype is that it is currently owned by eBay. eBay are a very good company, in that they are very good at being a company that does good for itself with little care elsewhere while occasionally pretending otherwise (like every now and then they have a "no PayPal feeds on donations to charity X" run).

50 points by rl1987 15y ago

i spent a half hour reading that skype reverse engineering pdf a week ago and just for kicks took a look at http://en.wikipedia.org/wiki/Skype_protocol http://en.wikipedia.org/wiki/Skype_protocol and it doesn't appear to me that the private keys are shared nor that they're generated in an insecure manner... so how would skype be eavesdropping? the article makes the case that skype is evil due to an intentionally weak protocol but doesn't back it up with a technical argument as to what's wrong with it. i'm not defending skype, just confused.

mfjordvald 15y ago

This was posted in 2007, worth keeping in mind before jumping to conclusions.

crocowhile 15y ago
Well, the main message still holds true though: if you need to make sure nobody can eavesdrop your communications, you'd better off with open source software.
- weego 15y ago
  As long as you understand the code line by line and as an overall entity, otherwise you are no better off. Just because you can read the source doesn't mean you actually can.
  - lucasjung 15y ago
    With open source, the chances that somebody will catch a security flaw are generally much higher. It's not necessary for each individual user to understand the code as long as some people do.
  - crocowhile 15y ago
    I am not the only human being on this planet, you know (And if I were I would not need skype anyway).
  - vabole 15y ago
    Even if you can not read and understand the code you are still better off with the open source. Due to the fact that independent researchers or programmers unaffiliated with developers will be able to audit the code. While with the closed source software, the only information you have about the inner workings of the software is provided by the developing company.
- slavak 15y ago
  Not that that guarantees anything, of course... http://c2.com/cgi/wiki?TheKenThompsonHack http://c2.com/cgi/wiki?TheKenThompsonHack If you need to _make sure_ nobody can eavesdrop on your communications, you better be ready to design and manufacture all hardware and software you're using yourself.
  - crocowhile 15y ago
    I wouldn't be so extreme. It's reasonable to assume that a properly encrypted connection is secure form entry to exit. You would have to use proprietary tools only at the extremities then, which is actually quite feasible nowadays. anyway: after learning that not even Osama wasn't even encrypting his shit my view on security is slightly different.

nextparadigms 15y ago

I wonder if this has anything to do with that "bug" that gives root access to Macs.

muuh-gnu 15y ago

I'm so tired of articles how bad/evil/insecure Skype is, while not suggesting any usable alternative. Skype, whether you like it or not, has no viable competition, almost 8 years after its initial release. By "usable" I have the following requirements in mind: * Cross platform: It has to offer clients for Linux, Win, OSX. * It has to support voice and video. * Easy to install: Even grandparents in Australia have to bee able to install it. No NAT and other configuration bullshit, just enter a name, a password and ready to go. Skype has helped connect my all over the world scattered family for more than half a decade now. I am absolutely willing to give up any kind of privacy and security in order to be able to video-phone my family living thousands of miles apart whenever I want at absolutely no cost. No, absolutely no free software system has yet been able to provide the above 3 minimum requirements for me to consider ever leaving skype. P.S. Thanks for the immediate downvotes.

gniv 15y ago
http://www.google.com/chat/video http://www.google.com/chat/video
- muuh-gnu 15y ago
  No free software. Theres no point in replacing one closed system by another, especially when the first one works much better. Googles system is only accessible through Gmail, is very awkward to use and has the "irrelevant addon" feel. Had Google _ever_ intended to offer widescale Voice&Video, they'd have built video into Gtalk when they had the chance.
  - sabat 15y ago
    Actually, Google's video/audio calls work in the browser. Not only is the software free, but you already have it.
    - codeup 15y ago
      You mean that only the browser is software, but not what runs in the browser?

sigzero 15y ago

If we continue to label everything "Evil" when it is clearly not the word will lose its meaning.

nck4222 15y ago

"Do I know that NSA helped fund eBay’s purchase of Skype? No, I certainly do not." It then links to an April Fools article (http://www.oreillynet.com/etel/blog/2007/04/skype_revenue_from_national_se_1.html http://www.oreillynet.com/etel/blog/2007/04/skype_revenue_fr...) to help support that there's a link between the NSA and Ebay anyway. EDIT: Maybe I missed the joke, since the name of the blog is ultra paranoid, but that article was garbage.

nikcub 15y ago

Article is from 2007 and most of it turned out to not be true . When Skype is served a subpoena, they can only return account information, they are unable to intercept or log voice or video calls[1] [2]. This is a big deal in China and Russia[3] where they block the service since they have no way of intercepting it (ie. it is secure enough for two very large governments to have no way of dealing with it). Further proof is that there are no publicly known cases where skype call or chat logs have been submitted as evidence, while you see google, microsoft, ebay, craigslist etc. appear all the time. Skype is an independent company again - and the reason why eBay bought it back then is revenue ($850M pa last year), not some conspiracy theory outside of the odd client exploit, skype is safe. I would trust it if I was a dissident in an unfriendly foreign country and needed to communicate securely. [1] http://www.voiptechchat.com/tech/34/skype-says-no-to-wire-tapping/ http://www.voiptechchat.com/tech/34/skype-says-no-to-wire-ta... [2] http://news.cnet.com/8301-13578_3-9962106-38.html http://news.cnet.com/8301-13578_3-9962106-38.html - see skype only IM company that does not comply with wiretap requests [3] http://arstechnica.com/telecom/news/2009/07/russia-not-the-first-to-see-skype-as-a-security-threat.ars http://arstechnica.com/telecom/news/2009/07/russia-not-the-f...

deleted 15y ago
[deleted]
horatiumocian 15y ago
Indeed, the fact that Skype was spun off by Ebay, and is preparing for an IPO with close to $1Bn in revenue, contradicts a significant part of this conspiracy theory. Although, it still could be true.
vabole 15y ago
1. Skype is not blocked in Russia. Federal security officials voice their concerns about Skype every once in a while, which causes rumors about possible blockage in media. Although nothing came out of it yet. 2. In China all skype servers redirect to their Chinese partner http://skype.tom.com/ http://skype.tom.com/ Tom Skype has everything that you would expect in QQ or other Chinese IM's, namely intrusive ads and content filtering. There is research showing how much data is leaked by the Tom Skype and how insecurely it is stored. http://www.nartv.org/mirror/breachingtrust.pdf http://www.nartv.org/mirror/breachingtrust.pdf It is quite worrying that Skype has a such partner. Although it makes me think that Google would have more success in China if it found a Chinese partner like Tom Google.

trotsky 15y ago

The NSA (and FBI et al.) have a pretty workable solution for strong encryption on the wire - they attack the client. The client computer (or mobile) is pretty much full of holes, if someone wants in they'll get in, and sooner rather than later. Related, the Germans seemed to have commissioned a trojan to monitor skype and tls traffic on the endpoint: http://www.wired.com/threatlevel/2008/01/leaked-document/ http://www.wired.com/threatlevel/2008/01/leaked-document/ Somewhat related, the FBI routinely uses flaws to install CIPAV: http://www.wired.com/politics/law/news/2007/07/fbi_spyware http://www.wired.com/politics/law/news/2007/07/fbi_spyware Granted, none of this enables the wholesale monitoring of skype communications. Practically, even if the NSA had access to individual signing keys or some kind of side channel leakage it probably wouldn't be getting used en masse. The computation requirements of decrypting all traffic are likely significant, and operational security would discourage the wide use of a closely held leakage bug in fear of disclosure like happened with the domestic wiretapping scandal. As an aside, I found it quite amusing to read "For example, a person in Germany, talking to a person in Russia using land-line phones would previously have been out of reach for NSA" - ultraparanoid? Pshaw.

dspillett 15y ago

The word "evil" if much overused these days. Slipping a little of topic: my main reason for distrusting Skype is that it is currently owned by eBay. eBay are a very good company, in that they are very good at being a company that does good for itself with little care elsewhere while occasionally pretending otherwise (like every now and then they have a "no PayPal feeds on donations to charity X" run).