15 ms·
Https URLs posted in private Skype chats visited by Microsoft
- wslh 13y agoSomeone tried putting terrorist related texts/images/videos in gmail or some other webmail to see if a third-party tries to read your information? It's a good honeypot.
- deleted 13y ago[deleted]
- BadCRC 13y agocouldn't they be using this to prevent/detect spam? edit: the article claims this can't be so because the page only does a HEAD request, though a HEAD request could be useful if you wanted to detect an HTTPS domain with ephemeral pages (which perhaps, could be a good feature in detecting spam domains)
- pfg 13y agoI wonder why they would only do it for HTTPS URLs if spam detection/prevention is the reason.
- 7952 13y agoPerhaps checking the certificates?
- bluefinity 13y agoI can confirm that HTTP links, not just HTTPS, are visited by a Microsoft IP if you paste them in to Skype. I noticed it happening a couple of weeks ago.
- pfg 13y agoThat makes more sense. Thanks.
- zokier 13y agoWith HEAD you should get Content-type -header, which could be used for detecting malware (ie if the content type points towards an executable). Frankly I'd be more worried about web-services that carry authentication in the URL than Skype checking them out.
- tlow 13y agoFTA: No. It is not a fitting explanation for spam or phishing prevention. The author claims that these sites rarely use https. Furthermore they used test URLs containing hypothetical login credentials and showed how skype would get access to these. The last troubling bit the author points out is that there seemed to be anomalous traffic to URLs shared in a skype conversation, where a microsoft IP seemed to attempt what they call a "replay attack".
- nivla 13y ago> It is not a fitting explanation for spam or phishing prevention. It is very common for spammers to break into other websites (using simple well known exploit) and create links redirecting to the site hosting the malware. So a site should not be excluded just because it has SSL. Edit: "should" -> "should not"
- bskap 13y agoBecause "rarely" means "they should just ignore them- no malware hoster would ever use HTTPS, especially not if they ever figured out that Microsoft was only checking HTTP URLs". Also, anyone sending log-in information in a GET request is doing it wrong.
- sriramk 13y agoI don't know about Skype but I know other parts of MSFT would frequently try and classify links on whether they had malware, whether they were phishing attempts and so on. Doing this on IM networks was important as they could cause so much distribution of such malware through automated sending of messages. I would be surprised if Microsoft wasnt doing this as it would leave users at risk. Also, sending login credentials over HTTP GETs? That's a pretty contrived scenario. The HTTP HEAD might be a red herring - it might just be checking to see whether it redirects somewhere else/whether the URL has already been seen. Perhaps this URL didn't set off the spam/malware machine learning models to initiate a full crawl/human review.
- mifchip 13y agoYou are using MSFT, FB, GOOG, AAPL? Dude, they are watching you every day :) dont even try to buy pressure-cooker after Boston, if you are using pressure-cooker - you are probably terarito! Idiots could even ban chemistry in schools and universities :) because everyone who has brain can boil kind off explosive in the kitchen… Heay motha faka, keep watching everyone… sakaz. Idiots will probably ban KNO3, NH4NO3 and other gardening chemicals after all, they also should ban petrol, because… i would not post any recepie, but after studieng chemistry in university, you can make really dangerous things. Oh yeah, also fakaz ban all the books entitled chemestry…
- mifchip 13y agoBig braza iz watching you. Continuing my previous comment… They also have to watch every one who buys toilet cleaning stuff, everyone who buys pipes, wood, everything, monitor everything, every step, every sneeze, every fart. Dump idiots. They are healing breathing disease through the asshole using knife in condom, yeah baby. USA!
- watt 13y agothey have english version already: http://www.h-online.com/security/news/item/Skype-with-care-Microsoft-is-reading-everything-you-write-1862870.html http://www.h-online.com/security/news/item/Skype-with-care-M... you don't need to run it through translator.
- deleted 13y ago[deleted]
- recoiledsnake 13y agoFrom the article: "A spokesman for the company confirmed that it scans messages to filter out spam and phishing websites. This explanation does not appear to fit the facts, however. Spam and phishing sites are not usually found on HTTPS pages" From the very next story down from the same publication: http://www.h-online.com/security/news/item/Trojans-conceal-themselves-using-instant-messaging-protocols-1789045.html http://www.h-online.com/security/news/item/Trojans-conceal-t... "The company has reported that, since 2009, some malware has been concealing its data traffic by mimicking known instant messaging protocols or, to avoid detection, trying to camouflage its data traffic as HTTP or HTTPS. To achieve this, these trojans copy at least the header of the instant messaging protocol, leaving the remainder of the packets to carry the trojan's encrypted communications." Looks like they're contradicting themselves here to score some click-bait headlines.
- Dylan16807 13y agoWhat is the contradiction? A program might be able to 'camouflage' its data as HTTPS to a casual observer but that has nothing to do with HTTPS urls. An HTTPS url won't work unless it's real. Therefore such a thing provides zero justification towards checking HTTPS urls.
- vidarh 13y agoThe only thing that is required to make a https url "real" is that it is hosted on a server that serves up a certificate that is valid for that domain. It's trivial enough to obtain a valid cert anonymously (shell company with bearer shares somewhere suitable) or find places to upload the malware that makes it available on https urls.
- atomaka 13y agoThis doesn't seem to be an uncommon practice. If you still use AOL Instant Messenger, it does the same thing.
- hosay123 13y agoWithin 15 minutes of setting up a https CI environment, complete with robots.txt, Googlebot was hitting the DNS name which also wasn't public or previously used or easily guessed. All the team use Gmail and one was using Chrome.
- TheAnimus 13y agoIsn't that part of the TOS for Chrome? They use your browsing activity to improve the search results. I remember a storm in a teacup about MS doing this via their browser toolbar.
- nivla 13y agoGoogle gets a lot of leeway from people. If you have done SEO, you will learn that the Googlebot doesn't always respect the robots.txt. Requesting to de-index a page may take weeks or even months. The quickest way is file a DMCA complaint for the link to your own site. Recently, they started tracking all downloads made on Chrome (for malwares), it includes the filename, the URL, IP and the timestamp. Sucks hard since I love Chrome and the only way to disable it is to disable the website malware checker (which only uses part of the hashes anyway).
- npsimons 13y agoAnd people wonder why I run my own email and XMPP servers.
- UnoriginalGuy 13y agoNobody wonders why. They just question if you're getting value for your time and money. For a lot of people spending >$100/year and many hours maintaining it isn't worth it.
- uncoder0 13y agoI tested this with Facebook a while back. I put two videos up of various lengths and linked to them directly by IP in Facebook chat. I also included a restrictive robots.txt. In both cases Facebook downloaded the entire videos from my server. I repeated the experiment with several other providers and the results were varied. Skype, for example, does not download the entire video and seems to respect the robots.txt... Not sure if this is still the case for Skype but, I just tested on FB again and they pulled the whole video...
- 0x0 13y agoIsn't that typically done to show thumbnail previews under the pasted links?
- choult 13y agoFacebook generally will present the OpenGraph data from pasted links; for sites lacking it they might present the first image on the page. It would be vast overkill to download a whole video just to present a thumbnail, and the user experience in the delay while the whole file is downloaded and processed would render the feature fairly useless. Which leaves the question of why Facebook would do this open... It might just be really bad practice and an under-/non-optimized crawler.
- Cthulhu_ 13y agoOr they download the whole video to pull it through an analyzer to look for stuff prohibited to be republished via FB, such as child pornography. If I were FB, I'd screen everything published via my site.
- mtgx 13y agoIs any of the big IM companies going to offer OTR encryption by default or what? It's not like they could make a ton of money by monitoring the chats, and even if they did, they shouldn't be doing that anyway. At least with e-mail they have an excuse for not using local encryption (it gets too complicated for the end-user), but they can't really use that excuse for chatting. So why isn't OTR enabled like yesterday in Gtalk, Skype and Yahoo Messenger? (by default of course, otherwise 99% of the users won't use it).
- exDM69 13y ago> So why isn't OTR enabled like yesterday in Gtalk, Skype and Yahoo Messenger? (by default of course, otherwise 99% of the users won't use it). In order to comply to requests from law enforcement agencies, end-to-end encryption is not used by public companies offering communication services.
- mtgx 13y agoIs this an official thing, like are companies legally forced to not offer it? Or is it more of an "unwritten" policy, that in order to "make law enforcement happy" they don't offer that type of encryption?
- yajoe 13y ago(Worked on RMS and Exchange) The govt comes by with a subpoena (secret, classified, or public) and requires Microsoft or the customer company to produce communication records that exist in a form that may be used as evidence. Failure to do so is best contempt of court and worst obstruction of justice. No 5th amendment privilege for other people's crimes. So everyone who chooses to store or process messages makes it so the encryption is reversible and they can honor court requests. Nothing is private as a result. EDIT: I should make it clear I don't agree with the current status quo. Let me answer two very good questions. > Would they also do that if logging failed during the period requested? If it can be shown that there is a willful neglect of collecting logs then the govt in the past has gone after companies for some form of conspiracy (most famous: MegaUpload, but Microsoft customers have had their fair share for accounting and securities fraud) or criminal negligence. There is a prevailing theory that companies are responsible for employee actions, and failing to log is seen as unacceptable. It's only recently (within the last year) that the courts have ruled whether compelling passwords is protected by the 5th amendment, and most systems in place were designed and built using previous assumptions from 10 years ago. > If this is true, why is OTR offered at all? It's a checkbox feature required for HIPAA, PCI, and similar. "Must have encryption" -- the standards and IT departments don't say how the keys are managed.
- recoiledsnake 13y agoAlternate headline: Microsoft protects hundreds of millions of Skype users by going to the effort of checking even https URLs in chat for malware and spam.
- cooldeal 13y agoReminds me of this HN post. "New Skype malware spreading at 2,000 clicks per hour to mine Bitcoins" https://news.ycombinator.com/item?id=5502028 https://news.ycombinator.com/item?id=5502028 One of the choice top HN comments: "Why does Skype even have any clickable links in it at all if Microsoft can't be bothered to keep the obvious malware out?" Another comment: "Re the conclusion: to protect yourself, don't run an OS that will silently install software just because you clicked on a blue link in a program published by the OS vendor. Steve Ballmer should be jailed as an accessory for allowing this." Damned if they do, damned if they don't.
- pessimizer 13y ago>an OS that will silently install software just because you clicked on a blue link in a program published by the OS vendor They're not damned if they don't do this. Not doing this would solve the problem. What's your point?
- jlgreco 13y agoI don't think either removing clickable links nor fixing "OS that will silently install software just because you clicked on a blue link" should only be possible by allowing themselves to eavesdrop.
- mr_luc 13y agoOkay, first, I'll just say it: I'll bet Microsoft has a team of developer-relations/pr people commenting on HN. HN is so important to the startup world, and Microsoft sees tech evangelism as war ... https://news.ycombinator.com/threads?id=cooldeal https://news.ycombinator.com/threads?id=cooldeal Maybe it's not you, but I bet it's happening.
- 13y ago
- pbhjpbhj 13y agoSo, you post a comment in a private Skype "please don't visit this link, it's copyright and reproduction of a single copy requires a license at a cost of $10 million USD due to the sensitive nature of the content". You make sure the link is to a brand new unshared domain with robots.txt denying access. MS download and you've got them on copyright infringement for which there is no apparent excuse outside of wilful negligence. What's the multiplying factor the MPAA use for copyright infringement, something like 1000 times the regular licensing fee. ... 4) Profit
- grecy 13y agoMaybe I'm sick, but sometimes I dream of a world where there a people that actually go out and do stuff like this, to bring attention to the stupidity of some laws.
- mikeash 13y agoI imagine some people do go out and do it, then realize that it's ridiculous and pointless, perhaps after every lawyer they contact tells me that there is no way they would take such an insane case.
- VikingCoder 13y agoWorse, you make it destruction. "Bob, if you should ever need to delete 100% of the content that I've created for you, you would follow this URL. Let me be clear, it will destroy USD $1,000,000 worth of goods."
- oinksoft 13y agoWell per the HTTP standard, GET requests should be idempotent. I kid, but imagine seeing pompous development advice stapled to official justification for some internet sleuthing!
- andreyf 13y agoI didn't realize this was part of a standard. Could you link to the section you're referring to?
- cddotdotslash 13y agoWell if you're passing session data in a URL (logins or passwords as parameters, not the typical one-click to activate one-time links) you're doing something wrong. Second, Microsoft has no way of distinguishing a normal URL from a URL that has an &password parameter at the end. And finally, perhaps one of their bots is simply crawling the link to, like Facebook does, display a link summary or thumbnail. Or, as the article says, looking for spam. I think it's pretty well documented at this point that Skype is not a secure video/chat product. But for the 99.9% of users outside of the "never read my data" echo chamber, it seems to be working fine for them. Use what works for you.
- sp332 13y agoIf you paste a "one-click to activate one time" link into a Skype session, the bot will click the link and then it won't be valid anymore for the legitimate recipient. That's a terrible idea.
- Ergomane 13y agoThe "one-click to activate one time" links should always lead to a page where the user has to perform a POST to prevent "smart" applications from using the token when trying to show a thumbnail / preview or offer other services. eg KDE (old) http://drupal.org/node/24398 http://drupal.org/node/24398
- wting 13y agoWhen MS bought Skype they changed supernodes from peers to company owned Linux boxes.[0] This change gives them the ability to eavesdrop on any conversation. My friend "Alice" (a Chinese national studying in the US), recently sent a present to her friend "Bob" in the Chinese army and talked about it on Skype. The Chinese Army found out that Bob was receiving a gift from the US and tracked down the relevant Skype conversation. Bob was interrogated about Alice and what the gift was for. Microsoft complies with all governments' legal requests, as it should. I have no doubt the US government has made similar requests of MS. Skype's original protocol made eavesdropping harder, but not after the changes Microsoft made. [0]: http://arstechnica.com/business/2012/05/skype-replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/ http://arstechnica.com/business/2012/05/skype-replaces-p2p-s...
- aleksi 13y agoIt has nothing to do with Microsoft and Linux boxes. They host headless Skype version for p2p network reliability: http://blogs.skype.com/2012/07/26/what-does-skypes-architecture-do-2/ http://blogs.skype.com/2012/07/26/what-does-skypes-architect... Your story is all about China. Skype for China is "special": https://en.greatfire.org/blog/2012/dec/china-listening-skype-microsoft-assumes-you-approve https://en.greatfire.org/blog/2012/dec/china-listening-skype...
- duaneb 13y agoRegardless of their supposed intentions (which they could easily lie about--this IS a business we're talking about), the supernodes do allow very easy eavesdropping given a warrant.
- jlgreco 13y ago> Microsoft complies with all governments' legal requests, as it should. For governments from the set of countries that Microsoft has a presence in, or just from governments in general? I can't imagine they respond to DPRK requests, nor should they.
- ma2rten 13y ago
- rayhoffman 13y agoThink about the combination of this monitoring with the U.S. CISPA data-sharing provisions: Microsoft says they are logging and pulling the content of links shared via Skype for spam and malware prevention. This certainly falls under the umbrella of "cybersecurity". Under CISPA, this "cybersecurity" information can be freely shared with the U.S. government without fear of liability, and can be further shared among all government agencies. This sharing is probably happening already. But CISPA would allow it to be brought out into the open and, particularly, for evidence so acquired to be used in court proceedings and as supporting evidence for search warrants.
- pornel 13y agoIt proves that Microsoft is able to decrypt chats and that's unfortunate. Switch to application that has end to end encryption if that's important (e.g. Jabber with OTR protocol on top http://en.wikipedia.org/wiki/Off-the-Record_Messaging http://en.wikipedia.org/wiki/Off-the-Record_Messaging). But making HEAD or GET requests, whether it's HTTPS or not, shouldn't be a problem — those HTTP methods are not allowed to have any significant side effects. Scanning of URLs is useful for such service that is often abused to send spam, phishing and exploits.
- huhtenberg 13y agoThere is a similar problem with SmartScreen, also courtesy by Microsoft. You, basically, send an email with a link to someone in Europe only to see it being accessed from some random US IP that doesn't even have a PTR record. With some effort this IP can be traced back to SmartScreen, but what's strange is that it sometimes takes hours for the URL to get hit from such IP. This doesn't make any sense whatsoever, because SmartScreen is supposed to be a pro-active defense against phishing and malware, so it should really be scanning new links in real-time, upon reception. This scenario is arguably even more troublesome than Skype's snooping, because it's not possible to predict beforehand if the mail will end up getting SmartScreen'd. [0] http://en.wikipedia.org/wiki/Microsoft_SmartScreen http://en.wikipedia.org/wiki/Microsoft_SmartScreen
- nivla 13y agoI am confused, I thought SmartScreen was for downloaded files and website visted through Internet Explorer. What does it have to do with emailing links? Also as far as I understand, SmartScreen only sends in the hashes/part of the hashes to get a match.
- ziko 13y agoBasically everything on the internet is coming a postcard rather than a letter in an envelope. I'm not sure I can accept that.
- timrogers 13y agoFacebook does this as well - they will hit any URL you post. This doesn't prove any malice, in fact, quite the opposite.
- sp332 13y agoBut Facebook doesn't pretend to have a secure network. Skype often claims to have a secure, encrypted network.
- justncase80 13y agoIt don't think visiting links nullifies the security and quality of encryption of a network.
- sp332 13y agoIf someone visited a link, that means they read it. Which means it was decrypted, which means it's not encrypted and secure.
- timrogers 13y agoThat seems like something of a bizarre argument - there's a different between a computer reading it and a person doing so. I'm not convinced privacy is infringed if it goes through, perhaps detects particular phrases (which are presumably related to illegal activity in any case) and checks links for malware. I don't have a problem with that.
- sp332 13y agoYou have no evidence for any of that. You literally just made that up. We don't know what people or what computers have this information, how long they are keeping it, or what they are doing with it. See, if the communications network was really secure, we would have an answer for all those questions.
- biafra 13y agoProbably a better translation: http://www.h-online.com/security/news/item/Skype-with-care-Microsoft-is-reading-everything-you-write-1862870.html http://www.h-online.com/security/news/item/Skype-with-care-M...
- GigabyteCoin 13y agoIt's probably just an algorithm checking that page for javascript exploits/drive by downloads/etc.
- celerity 13y agoIf you don't control it, treat it as virtually public. I do that with Skype, Gmail, Google Docs, iCloud stuff, Evernote, Dropbox etc. Don't trust it if you can't encrypt it with a private key.
- hughes 13y agoWhat IM protocol do you use? Or do you simply restrict all sensitive communication to encrypted email?
- seanmcdirmid 13y agoLync is used by a lot of enterprises.
- marshray 13y agoIf you want to chat privately, use OTR https://en.wikipedia.org/wiki/Off-the-Record_Messaging https://en.wikipedia.org/wiki/Off-the-Record_Messaging, authenticate your key fingerprints, ensure that neither party's chat program is logging, and that both computers are free of malware.
- bifrost 13y agoThis happens when you install toolbars as well, you think a URL is private, then all of a sudden private URL's are getting hits from googlebot/etc. Its not a big leap to assume that this happens in anything else...
- onemorepassword 13y agoPeople who defend this under the heading of "it's their service, don't use it if you don't like it", or "they're doing this for your convenience" completely miss the point. There is a reason why we had strict regulations (a dirty word on HN, I know) for "old fashioned" mail and telephone. To eavesdrop on people's private communication was considered a disgusting practice that belonged in totalitarian regimes, and an unacceptable violation of people's rights. Modern online services have circumvented such regulations, but that doesn't make what Microsoft, or Facebook, or Google are doing any more ethical or socially desirable. All of this casual disregard for basic ethics can't continue without a serious backlash. And such a backlash won't just hit Microsoft e.a., but our entire industry. It's time we stopped considering ourselves to be untouchable just because the law hasn't caught up yet, or because the majority of the people haven't figured out what the fuck we're doing. Some changes through technology are unstoppable. This however, isn't one of them. It's a choice.
- doki_pen 13y agoDo you really thing the law will "catch up"? It seems that things are headed in the opposite direction, and I don't see changing course anytime soon.
- criley 13y agoI find it ridiculous to think that early telephone companies did not abuse the privilege their hardware gave them. Back before it could be tracked and recorded? When it was analog and switchboards? Even if we had strict regulations, it would be all but impossible to prove impropriety of the snooping variety. I think this is a problem we've always had that is being magnified by technology that allows us to realize that it is occurring.
- mattsfrey 13y agoThe story of ultra-wealthy shipping magnate Aristotle Onassis is very interesting to read about. He was brazen in his profiteering and I've read stories that his rise to fortune started by eavesdropping on wealthy citizens making deals and buying stock etc when he worked as a telephone switchboard operator.
- X4 13y agoHere's the Skype Icon I made, when it wasn't clear what type of "Federal Trojan" the German Governmnent developed and used. http://image-upload.de/image/4f96S5/4af43ed70c.png http://image-upload.de/image/4f96S5/4af43ed70c.png I suspected Skype was used, because it would be the most effective way to spy citizens. Today Skype, Facebook and Gmail are valueable resources for a Orwellian Surveillance Government. These Skype Security articles are worth reading: http://en.wikipedia.org/wiki/Skype_security http://en.wikipedia.org/wiki/Skype_security http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-CCR_Fabrice_Skype.pdf http://www.ossir.org/windows/supports/2005/2005-11-07/EADS-C... http://cryptanalysis.eu/blog/2011/12/28/encrypted-traffic-mining-tm-e-g-leaks-in-skype/ http://cryptanalysis.eu/blog/2011/12/28/encrypted-traffic-mi... http://en.wikipedia.org/wiki/Skype_protocol http://en.wikipedia.org/wiki/Skype_protocol
- justncase80 13y agoThere's no such thing as a private URL.
- buraksarica 13y agoIf MS doesn't request a GET operation, is this still a privacy issue? The writer is bombing his/her own theory with saying "MS cannot understand if the site is phising related or not, by just sending HEAD request".
- namank 13y agoThe real concern would be if login credentials were sent through Skype and Microsoft used those to gain unauthorized access.
- deleted 13y ago[deleted]
- OGinparadise 13y agoApparently it says so on their privacy page: http://www.skype.com/en/legal/privacy/ http://www.skype.com/en/legal/privacy/ Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links. In limited instances, Skype may capture and manually review instant messages or SMS in connection with Spam prevention efforts. Skype may, in its sole discretion, block or prevent delivery of suspected Spam, and remove suspicious links from messages. If phishing and malware was spread thanks to skype, what would people say?
- shmerl 13y agoPeople still use Skype? Some never learn.
- skeletonjelly 13y agoWhat do you use then? Skype fits the bill for a lot of people.
- shmerl 13y agoXMPP and Jingle. OTR with ZRTP on top of that.
- jokoon 13y agoIt's funny to watch documentaries about the collapse of the soviet union and then read about US companies doing this. As long as a government is not doing it, I don't really any problem. But if american companies sell those tech to other countries, maybe there's a problem. Aren't there laws that prevent US companies to sell spying tools to some countries ? I really think that as time pass, the world will want more and more p2p or pseudonymous/anonymous techs to evade such problems.
- bangsta 13y agoWhen you put a link into any MS service, MS proxies it, just like google proxies your clicks on a search link. If you dont want MS having access to things you access, dont use their stuff. Personally, I think its anti-web and anti-user to do this, as URL rewriting for the purposes of tracking and storing and analyzing is intrusive and an abuse of the anchor tag that was never intended.
- alinspired 13y agoI can confirm a case of http (not httpS) link sent in skype accessed from microsoft. Access happened from 65.52.100.214 about 6hrs 40 minutes after I shared it in skype. There were 4 http requests, while I shared the link with 2 people. Unfortunately the server logs are not detailed enough to understand what exactly been requested, given the page was under basic http authorization (with credentials NOT in URL).
- alinspired 13y agoThis suddenly escalated from "thread on HN" to personal encounter and realization that probably all Skype messages worldwide are stored by MS FOREVER...
- dewiz 13y agoI suppose no one is using gmail, gtalk, g+, g hangout, yahoo mail, etc etc here? The web is open, putting credentials in urls is stupid, and complaining about spider hits is too. If you think your URLs are safe because no one KNOWS about them, you are simply doing it wrong. Hopefully your URLs are not changing any server side resource, otherwise you have a bigger problem than a spider. Have you considered those spiders might be verifying that you are not spamming your friends, e.g. your computer could be infected and MS is trying to help your friends?
- vidarh 13y ago> If you think your URLs are safe because no one KNOWS about them, you are simply doing it wrong. Case in point: I regularly bring up test web servers on my home server on weird ports, and Googlebot regularly finds them; I don't particularly care - anything I want to be private I password protect, but these are sites that are linked from nowhere. But there's any number of acceptable way it could find them: Some of the tools I use have default setups of Google Analytics that'd leak any urls I visit on them; I often click through links to other public sites from them, and any of those sites might leak the referrer. So I agree with you that you should expect that URLs stay private. But you can still have privacy expectations about the exchange of a public URL. E.g. someone might not like the thought that there is potentially a record that they're visiting certain embarrassing sites. The reason there is a shitstorm over this is not that Skype is necessarily or even likely doing anything nefarious with the URLs, but that people had an expectation of privacy about their conversation that they then found out clearly is not being met. If Skype/MS wants to scan every link, or retrieve them and put the contents on billboards in public spaces, there's nothing inherently wrong with either option. What is wrong is not realising that the actions they are taking are at odds with peoples privacy expectations and making sure to communicate what their actual expectation should be to users.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]