5 ms·

Well, it's encrypted, so that seems like a reasonable alternative to the potential of being spied upon when using Skype.

by jstalin 14y ago

TranceMan 14y ago
So if we encrypt stuff we are not spied on? Naive....
- sdp 14y ago
  Encrypting data certainly increases the barrier to entry for spying.
  - TranceMan 14y ago
    No it doesn't, it means if somebody doesn't really want to spy on you they just will not waste their time....
    - artichokeheart 14y ago
      Isn't that the definition of a raised barrier? Even if it isn't very high.
    - amckenna 14y ago
      Yes it does. Adding encryption, even if it can be broken through sheer computational power, still increases the price tag associated with spying, therefore increasing the barrier to spying.
- homosaur 14y ago
  Yeah, but what does it matter then? I can stand outside the bank safe all day and stare at it but unless I know the code I'm still just looking at a locked box. Strong encryption is the same way, feel free to stare at my VPN stream all day, it won't help you.
  - TranceMan 14y ago
    You fail to get my point, why do you think that that the US has has little issue with allowing encryption to be used these days? How strong is your 'locked' box? It's only a bunch of 1s and 0s.
    - aeflash 14y ago
      Unless the NSA/FBI/whatever is decades ahead in mathematical research from what is common in academia, or has computers that are many orders of magnitude faster than what we have today, well encrypted data is basically random data to anyone who lacks the keys. That's a pretty tough locked box.
      - TranceMan 14y ago
        And who packages that box?
        pjscott 14y ago
        You're veering awfully metaphorical, but it might be relevant to point out that the crypto implementations in wide use today are typically open source, and the algorithms themselves are public, and widely reviewed by independent cryptographers who have no incentive to do anything sinister.
        teebs 14y ago
        In fact, they have a good incentive not to do sinister things. If they do, and other cryptographers find out, they will lose a lot of standing in the academic community.
      - temp453463343 14y ago
        "Unless the NSA/FBI/whatever is decades ahead in mathematical research from what is common in academia" I wouldn't be surprised. Basically 9/10 people that study cryptography in the US end up working for the NSA. Look at the NSA's budget, and then look at how many cryptography professors there are. However, that said, IF they managed to decrypt AES somehow, they are severely limited in what they can do with that information. Basically anything they do with the decrypted data has to in no way alert anyone that they have that capability. So that data DEFINITELY can't be used in court, nor for a whole array of other more covert operations.
dhx 14y ago
It may be encrypted -- but is it protected against traffic analysis? The following papers are a good starting point: [1] Guessing the URLs being browsed by users over an encrypted TLS session: https://research.microsoft.com/en-us/um/people/gdane/papers/TLSanon.pdf https://research.microsoft.com/en-us/um/people/gdane/papers/... [2] Guessing the co-ordinates of where a user is scrolling around on Google Maps over an encrypted TLS session: http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.... [3] Guessing the content of encrypted VoIP conversations: http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf [4] Guessing communication paths on the Tor network with only a partial view of the network (not strictly related to encryption but the principles of traffic analysis are relevant): http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.pdf http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.p... [5] Guessing passwords sent over the SSH protocol using keystroke timing analysis: http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf
- dhx 14y ago
  To explain further in the context of WebRTC, traffic analysis of the encrypted data could determine the pace and duration patterns of speech between multiple speakers. This could: (a) narrow down or uniquely identify each party (b) provide information on the mood of each party (are they interrupting other speakers more often than usual?) (c) guess the nature of the call (information dump from one person to another, one person quizzing another person, ...) (d) determine the languages used in the conversation (e) guess demographic information from the conversation including approximate level of education/intellect, age, male/female, ... (f) narrow down the physical location of speakers who are attempting to mask their identity through intermediate nodes
superuser2 14y ago
So is Skype. Unless there's evidence that Google couldn't be compelled to comply with US law and honor a legally binding order to intercept a Chrome video call?
- analog 14y ago
  Google wouldn't be able to intercept a peer to peer connection, isn't that one of the strengths here?
- josh2600 14y ago
  The intercept service you're talking about is CALEA if I'm not mistaken, and it's not yet clear that CALEA applies to IP communications. VoIP is covered by CALEA, but it isn't yet clear if Video is covered. There's a bit of a raging debate about this in Telco circles. There are basically two arguments: 1) Companies that do not operate exchanges are not liable for CALEA compliance 2) CALEA compliance is not clear. For the first argument, many folks interpret the law as only covering companies that have equipment inside of phone exchanges (CLECs and ILECs). There is a 3rd class of operator that is only IP with no equipment in the exchange. It is not yet clear if this 3rd class has CALEA as a requirement (Goolge is all IP). On the second point, there's no clear documentation about acceptable formats for release. Can I send raw log files? Does it have to be a csv? None of this is clearly defined anywhere. In short, it's a lot more tangled when it comes to video. I'm not certain the Feds could've gotten access to Skype monitoring without $MSFT buying Skype.
- nextparadigms 14y ago
  Yes, but Skype is not fully decentralized. Skype is no safer than any e-mail service.

Well, it's encrypted, so that seems like a reasonable alternative to the potential of being spied upon when using Skype.

by jstalin 14y ago

Well, it's encrypted, so that seems like a reasonable alternative to the potential of being spied upon when using Skype.

TranceMan 14y ago

So if we encrypt stuff we are not spied on? Naive....

sdp 14y ago
Encrypting data certainly increases the barrier to entry for spying.
- TranceMan 14y ago
  No it doesn't, it means if somebody doesn't really want to spy on you they just will not waste their time....
  - artichokeheart 14y ago
    Isn't that the definition of a raised barrier? Even if it isn't very high.
  - amckenna 14y ago
    Yes it does. Adding encryption, even if it can be broken through sheer computational power, still increases the price tag associated with spying, therefore increasing the barrier to spying.
homosaur 14y ago
Yeah, but what does it matter then? I can stand outside the bank safe all day and stare at it but unless I know the code I'm still just looking at a locked box. Strong encryption is the same way, feel free to stare at my VPN stream all day, it won't help you.
- TranceMan 14y ago
  You fail to get my point, why do you think that that the US has has little issue with allowing encryption to be used these days? How strong is your 'locked' box? It's only a bunch of 1s and 0s.
  - aeflash 14y ago
    Unless the NSA/FBI/whatever is decades ahead in mathematical research from what is common in academia, or has computers that are many orders of magnitude faster than what we have today, well encrypted data is basically random data to anyone who lacks the keys. That's a pretty tough locked box.
    - TranceMan 14y ago
      And who packages that box?
      - pjscott 14y ago
        You're veering awfully metaphorical, but it might be relevant to point out that the crypto implementations in wide use today are typically open source, and the algorithms themselves are public, and widely reviewed by independent cryptographers who have no incentive to do anything sinister.
        teebs 14y ago
        In fact, they have a good incentive not to do sinister things. If they do, and other cryptographers find out, they will lose a lot of standing in the academic community.
    - temp453463343 14y ago
      "Unless the NSA/FBI/whatever is decades ahead in mathematical research from what is common in academia" I wouldn't be surprised. Basically 9/10 people that study cryptography in the US end up working for the NSA. Look at the NSA's budget, and then look at how many cryptography professors there are. However, that said, IF they managed to decrypt AES somehow, they are severely limited in what they can do with that information. Basically anything they do with the decrypted data has to in no way alert anyone that they have that capability. So that data DEFINITELY can't be used in court, nor for a whole array of other more covert operations.

dhx 14y ago

It may be encrypted -- but is it protected against traffic analysis? The following papers are a good starting point: [1] Guessing the URLs being browsed by users over an encrypted TLS session: https://research.microsoft.com/en-us/um/people/gdane/papers/TLSanon.pdf https://research.microsoft.com/en-us/um/people/gdane/papers/... [2] Guessing the co-ordinates of where a user is scrolling around on Google Maps over an encrypted TLS session: http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.pdf http://www.ioactive.com/pdfs/SSLTrafficAnalysisOnGoogleMaps.... [3] Guessing the content of encrypted VoIP conversations: http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf http://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf [4] Guessing communication paths on the Tor network with only a partial view of the network (not strictly related to encryption but the principles of traffic analysis are relevant): http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.pdf http://www.cl.cam.ac.uk/users/sjm217/papers/oakland05torta.p... [5] Guessing passwords sent over the SSH protocol using keystroke timing analysis: http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf

dhx 14y ago
To explain further in the context of WebRTC, traffic analysis of the encrypted data could determine the pace and duration patterns of speech between multiple speakers. This could: (a) narrow down or uniquely identify each party (b) provide information on the mood of each party (are they interrupting other speakers more often than usual?) (c) guess the nature of the call (information dump from one person to another, one person quizzing another person, ...) (d) determine the languages used in the conversation (e) guess demographic information from the conversation including approximate level of education/intellect, age, male/female, ... (f) narrow down the physical location of speakers who are attempting to mask their identity through intermediate nodes

superuser2 14y ago

So is Skype. Unless there's evidence that Google couldn't be compelled to comply with US law and honor a legally binding order to intercept a Chrome video call?

analog 14y ago
Google wouldn't be able to intercept a peer to peer connection, isn't that one of the strengths here?
josh2600 14y ago
The intercept service you're talking about is CALEA if I'm not mistaken, and it's not yet clear that CALEA applies to IP communications. VoIP is covered by CALEA, but it isn't yet clear if Video is covered. There's a bit of a raging debate about this in Telco circles. There are basically two arguments: 1) Companies that do not operate exchanges are not liable for CALEA compliance 2) CALEA compliance is not clear. For the first argument, many folks interpret the law as only covering companies that have equipment inside of phone exchanges (CLECs and ILECs). There is a 3rd class of operator that is only IP with no equipment in the exchange. It is not yet clear if this 3rd class has CALEA as a requirement (Goolge is all IP). On the second point, there's no clear documentation about acceptable formats for release. Can I send raw log files? Does it have to be a csv? None of this is clearly defined anywhere. In short, it's a lot more tangled when it comes to video. I'm not certain the Feds could've gotten access to Skype monitoring without $MSFT buying Skype.
nextparadigms 14y ago
Yes, but Skype is not fully decentralized. Skype is no safer than any e-mail service.