Edited form of my comment from http://news.ycombinator.com/item?id=2590731 http://news.ycombinator.com/item?id=2590731, which discussed the same finding: - Sky

Edited form of my comment from http://news.ycombinator.com/item?id=2590731 http://news.ycombinator.com/item?id=2590731, which discussed the same finding: - Skype's encryption algorithm is not, itself, broken; - Skype uses a "prediction" algorithm (LPC) to compress voice streams; - therefore, words etc. have a specific pattern of bandwidth use; - bandwidth use of encrypted compressed data is equal to bandwidth use of data that has only been compressed; - these patterns (which can be detected "through" the encryption) allow fairly good reconstruction of the voice stream. If you like this kind of thing, Google "ssh keystroke timing attacks", or, more generally, "traffic analysis".