23 ms·

Skype backdoor confirmation

345 points by austengary 13y ago

UnoriginalGuy 13y ago
This is totally nit-picky, but strange use of the word "backdoor." When I read "backdoor" I was expecting to read about some malware-like functionality within the Skype client itself, but instead this is just telling us that Microsoft can read content after it is sent to them via the client and decrypted. I would prefer Microsoft stopped scanning/reading my conversations, and I agree that what they're doing (e.g. accessing URLs) is a problem (and arguably illegal, given the recent case about someone accessing insecured AT&T URLs and going to jail). Just think the original title could have been more clear.
- oelmekki 13y ago
  Seconded. It's more a man in the middle to me. Still a problem, though.
- austengary 13y ago
  A backdoor in their encryption protocol. They claim it is secure. "The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]" [1]: http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.
  - lucb1e 13y ago
    Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...
    - nicheuser 13y ago
      That quote isn't from the policy, it is from a third party audit that was done in 2005.
  - drivebyacct2 13y ago
    No. No. No, no, no, no. These are two different things. One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works. Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud. At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers. So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?
    - spellboots 13y ago
      I think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL. It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers. So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.
      - kvb 13y ago
        Or maybe the client forwards the URL to a Microsoft service which accesses it.
        notdang 13y ago
        If it did this, then it can forward the chat conversation as well
  - alfaomega 13y ago
    >Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice. Is it possible that the communication itself is OTR, but the Skype client receiving the message sends only the URLs to the server?
  - downandout 13y ago
    The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy. http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa... (this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).
- drivebyacct2 13y ago
  Besides this hair-on-fire title and intro, this is pretty much just yet another rehashing that Skype visits URLs in chats? (Honestly, if you'd just asked, I would have been assumed this would have been the case anyway)
  - mixedbit 13y ago
    You are aware that many popular services allow to share stuff privately using URL encoded credentials?
    - UnoriginalGuy 13y ago
      Indeed. Add this to the 1,000,000 other reasons why you should never use GET requests for authentication/verification.
      - mixedbit 13y ago
        What do you mean by 'using GET requests for verification'? I think you are mixing different concepts. The problem is caused by URL encoded credentials and has nothing to do with GET requests. It is perfectly fine (and often desirable) to authorize GET requests.
        UnoriginalGuy 13y ago
        You can only encode credentials in a URL via GET. Therefore if people stop using GET and start using POST (aka forms) for authentication this issue goes away. Even just a simple pin. GET issues are primarily related to the fact that an attacker can automate their access. So they could trick a user into going to a specially crafted site, and then request content on that user's behalf via GET forgery, and return it to the web-server you control. It is very convenient, but fairly insecure.
        jrochkind1 13y ago
        you are also ruling out HTTP auth, yes?
- ThomPete 13y ago
  Isn't it only a problem if they actually use it to identify you. If they just use it the same way that google uses gmail I fail to see the problem.
- np422 13y ago
  If you provide means for private communication, it's not preferred that it's private - it's a requirement. Gentlemen don't read each others mail.
  - tomjen3 13y ago
    Your last statement is so painful, because reality is so far from what it should be.
- mtgx 13y ago
  Considering there was an article just a few days ago in NYTimes [1] claiming that "Skype is so secure because of its decentralization" that law enforcement tries to pass laws against it, I'd say a lot of people aren't aware that Microsoft does have access to all the information at this point thanks to their "super-nodes", but even NYTimes writers aren't aware of it (or maybe it was just a cloaked advertorial for Skype). I'll also continue to say how extremely disappointed I am that none of the major IM players (not Google, not Apple, not Microsoft, not Yahoo, not Facebook) wants to implement OTR encryption in their chat apps. Google even removed their fake "OTR" from the new Hangouts app, which I believe only hid your logs from yourself, not from Google themselves. [1] - http://www.nytimes.com/2013/05/17/business/concerns-arise-on-us-effort-to-allow-internet-wiretaps.html http://www.nytimes.com/2013/05/17/business/concerns-arise-on...
  - Sami_Lehtinen 13y ago
    There are also truly distributed solutions like Bitmessage. https://bitmessage.org/ https://bitmessage.org/
    - johnchristopher 13y ago
      Thank you! I was thinking about MTUA, mail, crypto/privacy and bitsync yesterday and was wondering if there could be a new mail system that would be encrypted and decentralized by default (à la bitsync/bittorrent). Bitmessage seems to closely match what I had in mind.
      - amboar 13y ago
        check out syndie : http://syndie.i2p2.de http://syndie.i2p2.de
  - film42 13y ago
    But the whole purpose of the new handouts app is that all clients are syncd. That's kind of hard if 3rd party apps don't have the same ability. Then all you're left with is useless encrypted messages.
  - 13y ago
- glurgh 13y ago
  I don't think it's nitpicky at all - it would be different if Skype, Microsoft or anyone else had actually made a promise that messages that pass through their service are unreadable to them. While it's technically possible it's not the norm and it's hard to come up with examples of services that actually do make this promise - tarsnap is one that comes to mind.
  - rbanffy 13y ago
    Readable is one thing. Read and used is a completely different thing.
    - glurgh 13y ago
      Is it? Gmail reads and uses all mail and this doesn't seem to have generated a great outburst of controversy.
      - rbanffy 13y ago
        Yeah, right. While both Skype and Gmail store your messages (if you Skype across multiple devices, you'll see logs of conversations that happened on different devices), I don't think Gmail probes every URL you send in your messages. Also, SMTP is not always done under SSL, so, privacy cannot be assured. But that's easily testable. I'll get back to you in a couple hours.
        alfaomega 13y ago
        I am struggling to under the distinction you're trying to portray. One automatically scans your email to show related ads, another does a HTTP HEAD request to URLs for only the server headers, which they say is for malware scanning purposes. Both are automated jobs. See my other post to see how Google employees have access to all your email, documents, chat transcripts, Google Voice calls, Youtube videos etc. and how a few abused it to stalk teens. https://news.ycombinator.com/item?id=5728707 https://news.ycombinator.com/item?id=5728707 As usual, Google gets a free pass and Microsoft gets demonized(they should stop claiming it's end to end encrypted, though). Looking at your HN profile, it's not hard to understand why. Thanks for being honest about disliking Microsoft but please try not to let that color your objective opinions and playing favorites regardless of facts.
- zerr 13y ago
  Yup, title needs to be changed. After reading it, I immediately closed Skype.
RandallBrown 13y ago
That article was nonsensical. English probably isn't their first language, but I have no idea what they're saying.
- rdl 13y ago
  Indeed, Adam Back's first language is C or Perl I think.
- wfn 13y ago
  The slang is very common in crypto* newsgroups of these sorts, I didn't find anything unusual or un-parseable in the message.
  - vacri 13y ago
    The best I ever saw was when I had a subtle weird issue with a windows graphics driver. The only place I could find on google that looked like it had the answer was a Filipino gamer board... but the only problem was that the thread was a mix of English, Tagalog, and l33tspeak. I could tell that the answer was probably there, but I couldn't interpret it...
Havoc 13y ago
Could someone help me understand why the password changed from "bar" to "yeahright"? Or is that just a mistake on the authors side?
- claudius 13y ago
  He probably typed out the string in the paragraph and copy-pasted the logs, so likely it is just a mistake on the author’s side.
quackerhacker 13y ago
Don't be surprised. While I can see 2 sides to this argument (it was discussed earlier here on HN, link below), we shouldn't be too surprised by what some companies do to "optimize," their products. Microsoft autocrawling http(s) links could be either for obtaining new bing search results (and it could make that result relative to your conversation), or it could be for security to screen links. I don't know, but I agree that if you have a secret conversation, take steps like PGP to keep it secret. Big Brother is ALWAYS listening :: usually a good preventative security motivation ;) https://news.ycombinator.com/item?id=5721006 https://news.ycombinator.com/item?id=5721006
oelmekki 13y ago
I wouldn't be surprised it this was intended to help bing discover deep web. If it's the case, combine that with the ability on bing to do "ip:<ip>" searches, and you have a formidable tool for forensics.
- quackerhacker 13y ago
  I agree with this. I know that when I've done webdev and when I check out a unique sandbox url (like jumbled letters with no backlinks) for a page I'll design, I use to see GoogleBot crawl that page eventually in the logs. (guess what browser I was using...Chrome)
  - cskau 13y ago
    Chrome has all kinds of services like "resolve navigation error", "URL prediction" and "usage statistics". That Chrome sends your URLs out there on the Internet isn't exactly a secret. If it bothers you, you can disable some of the features under 'Privacy' on: chrome://settings/ The difference here is that Chrome doesn't pretend to be a secure communication channel like Microsoft claims Skype is.
maaaats 13y ago
This is misleading, it's not a backdoor. At least not my definition of backdoor. Anyways, if you need secrecy, don't use a service like this. I have read people speculating if it's for spam/malware protection. They screen the urls to see if it's a redirect to known malware.
- deleted 13y ago
  [deleted]
- burgreblast 13y ago
  Agreed. This is one of those "improve the service things". GOOG would do the same, but then sell ads against the data and everyone would say the ads are ok, because they're also operating a free, and very useful service.
buster 13y ago
Very strange article. It only re-does what all other news sources already stated.. plus, i think that commonly a backdoor is understood as something in the software itself that let's someone get access from the outside, which doesn't appear to be the case. Plus, to think that skype would be exempt from the governments claim to get access to all communications and messaging data is very simple-minded. The guy does realize that today governments can access all his mails, right? SSL/TLS or not.
- claudius 13y ago
  I have reason to believe that the government cannot access all my mails. But if it could, I’d be even happier, as it would either prove a fault in GPG (unlikely) or a working quantum computer implementing e.g. Shor’s algorithm. And who wouldn’t want to hear of the latter?
  - buster 13y ago
    I have reason to believe that you're wrong, because if you're under surveillance by the FBI or whatever, they will be able to read your mail. Unless you're the ultra-paranoid guy there are ways to get to your password physically :( (so, since you're coming up with GPG which i obviously was not referring to i can also come up with some unlikely scenario, ok?)
    - GhotiFish 13y ago
      I can't really think of how one gets around that link. I'm not sure what you mean.
      - buster 13y ago
        The point is that noone should act surprised because the laws already demand that communications can be intercepted and read. Of course that excludes GPG (or pasting encrypted text into your skype chat). And that is only true as long as your law enforcement doesn't have you on surveillance. Or unless you can be 100% sure that the NSA really really really can't crack your encryption. And even Bruce Schneier isn't sure about that: https://www.schneier.com/blog/archives/2012/03/can_the_nsa_bre.html https://www.schneier.com/blog/archives/2012/03/can_the_nsa_b...
ksk 13y ago
Have people checked if the client itself sends the URLs separately via some webservice (as opposed to MS being able to decrypt the IM) ?
- sp332 13y ago
  I have this question too. While still not good, this is the new best-case scenario.
nr0mx 13y ago
This is the company currently running ads positioning itself as a company that holds privacy dear. "At Microsoft, we take our responsibilities for protecting your privacy very seriously. It’s a priority across all our businesses, and an area where we continue to work closely with others throughout academia, government and industry." http://blogs.windows.com/ie/b/ie/archive/2013/04/22/consumer-survey-85-of-americans-are-concerned-about-their-online-privacy-far-fewer-take-action.aspx http://blogs.windows.com/ie/b/ie/archive/2013/04/22/consumer... "Your Privacy is Our Priority" "The lines between public and private may never be perfect, but at Microsoft we are going to keep on trying, because your privacy is our priority." https://www.youtube.com/watch?v=bt51MWll1oY https://www.youtube.com/watch?v=bt51MWll1oY
- mtgx 13y ago
  That's the most annoying thing about Microsoft's campaigns. Sure they may be slightly better in some areas than Google, but overall they are just as bad, or worse than Google when it comes to privacy. Maybe I'd get it if those campaigns came from Mozilla or DuckDuckGo (even though they are still done in poor taste, and resemble too much negative political campaigns), but Microsoft? I just can't take them seriously in regards to that. Microsoft is throwing stones from a glass house, and they should stop.
  - jlgreco 13y ago
    > resemble too much negative political campaigns Seriously, outside of politics they are the most negative ads I've ever seen. Even rival dishsoap or gym ads never get that extreme; nothing else compares. Did they actually hire a political advertising team or something?
    - pyre 13y ago
      IIRC, the Scroogled campaign was put forward by an ex-political campaign guy.
      - jlgreco 13y ago
westoque 13y ago
I guess it's time for Google Hangouts to shine.
- nicheuser 13y ago
  Why? Google can see everyone you do on them. I don't know why Skype being able to see the URLs is such a huge issue that people are saying they won't use it for business purposes, but at the same time we see people and companies use Google Docs, Google Apps, Gmail which allow Google to see all your business documents, spreadsheets and email. Is this because they think Google is somehow more trustworthy that Microsoft? I am not saying Outlook.com/Skydrive is more secure, but didn't a Google employee get caught reading Gmail information to stalk teens? Atleast Office is primarily used for storing files under your own control, unlike Google docs where you have no choice but to risk Google employees reading them.
- alfaomega 13y ago
  Why? I don't think it's encrypted in such a way that Google can't read it. References? I don't think you can trust Google with your chat and docs as well. From:http://www.wired.com/threatlevel/2010/09/google-spy/ http://www.wired.com/threatlevel/2010/09/google-spy/ >Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats. >David Barksdale, 27, was fired in July after he reportedly accessed the communications of at least four minors with Google accounts, spying on Google Voice call logs, chat transcripts and contact lists, according to Gawker, which broke the story Wednesday. http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...
  - SilvaR 13y ago
    That actually shows that Google has privacy policies that are to be taken seriously by their own employees
    - alfaomega 13y ago
      Is there anything to show Microsoft does not? All we have here is a server making HEAD requests, not even GET.
X4 13y ago
* Can you please recommend a cross-platform alternative? I only know of Gnome-Empathy/KDE-Telepathy and Pidgin that utilize XMPP's voice and video features. I've found this: http://octro.com/octrotalk.php http://octro.com/octrotalk.php which lacks a linux client, but appears to be solid and has a web-client too.
- sparkie 13y ago
  https://jitsi.org/ https://jitsi.org/
  - X4 13y ago
    I've tried jitsi for some time, but it crashes from time to time. It stores your passwords in cleartext just like pidgin does.
- aclevernickname 13y ago
  http://yate.null.ro http://yate.null.ro fully replaces Skype functionality (client and server), and works under mac/windows/linux.
  - X4 13y ago
    Thanks a lot for sharing! I hope they do more marketing and seo. I didn't find Yate, even after extended web searches. Congrats to the developers, I'll definitely try this one out!
rbanffy 13y ago
What if someone passes an internal (poorly designed) Microsoft REST API that damages something when HEAD is called?
- alfaomega 13y ago
  Then they fix the bug in the REST API and move on? A HEAD causing damage is a bug.
alfaomega 13y ago
>How far does this go? Do people need to worry about microsoft IIS web servers with SSL, exchange servers? You do have to wonder if apple backdoored their IM client, below the OTR, or silent circle, or the OS - I mean how far does this go? Jon Callas said not apple, that wouldnt be cool, and apple aims for coolness for users; maybe he should dig a little more. What? Why bring Apple into this? >Now are they just hoovering up the skype IMs via the new microsoft central server architecture having back doored skype client to no longer have end2end encrption (and feedind them through echelon or whatever) or is this the client that is reading your IMs and sending selected things to the mothership. Skype claims the changes were unrelated, not sure if believable but they have some details on them here. http://blogs.skype.com/2012/07/26/what-does-skypes-architecture-do-2/#fbid=VKAM4wOskXH http://blogs.skype.com/2012/07/26/what-does-skypes-architect... More interesting details here. http://www.zdnet.com/no-microsoft-and-skype-are-not-playing-big-brother-7000001565/ http://www.zdnet.com/no-microsoft-and-skype-are-not-playing-... >btw their HEAD request was completely ineffective per the weak excuse microsoft offered in the article at top my php contained a meta-refresh which the head wont see as its in the html body Yes, but if the links are spreading fast, you can expect more scrutiny. I think they're trying avoid situations like the below. "New Skype malware spreading at 2,000 clicks per hour to mine Bitcoins" https://news.ycombinator.com/item?id=5502028 https://news.ycombinator.com/item?id=5502028 Interesting comments on that article, including someone calling for Ballmer to be jailed because he allows malware links on Skype. How can they detect and stop malware with OTR?
tete 13y ago
Hey, there is an amazing alternative without setup time, P2P, open, standards compliant, ... And best of all it's a shameless ad for a story submitted by myself. ;) https://news.ycombinator.com/item?id=5729606 https://news.ycombinator.com/item?id=5729606
ancarda 13y ago
The main problem is most of my friends (even those who are programmers) cannot be bothered to spend the 20 minutes picking up alternative software so I'm stuck with Skype and Facebook as my primary means of talking to people.
- yarou 13y ago
  Convenience for privacy. :)
Bjoern 13y ago
This is yet another reason on my list why I welcome WebRTC so that we can get rid of problems like this.
rossjudson 13y ago
Checking URLs passed in messages isn't incompatible with secure communication. It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them (and verify that they're not pointing to bad stuff, which is a very valuable service to provide to the vast number of readers). We might find somewhere in Skype's ToS a reference to URL checking, for any URLs you send through the service. The URL checks could also be anonymized.
- betterunix 13y ago
  "Checking URLs passed in messages isn't incompatible with secure communication" I guess that depends on your definition of "security," and perhaps of "practicality." Where I'm from (i.e. a grad student whose research is on practical secure multiparty computation), a practical system for checking URLs in a privacy-preserving fashion is still very much a research topic. "It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them" How is that secure? Now the third party knows what URLs you are sending in your messages. "The URL checks could also be anonymized." Sure, but that is not what you are seeing here. You would need a mix-net of some kind, one in which the users themselves are participating (to ensure that there is at least one honest party). It is technically possible...but you're not going to see it happen, not any time soon. With the FBI talking about building back doors into everything, what incentive is there for a company like Microsoft to actually make such a secure system? When it comes down to it, most Skype users are too uninformed to even know how their software might betray them. On the other hand, the Justice Department could create plenty of difficulty for Microsoft if they failed to cooperate. Whose side do you think Microsoft will choose?
  - rossjudson 13y ago
    I'm not arguing that the communications stay theoretically secure. If there's any processing going on, they clearly don't. What I'm saying is that you break the message up into risk and non-risky parts, and the risky parts (URLs) can be treated differently. That different treatment is very valuable to the vast majority of users that don't care about complete security, but do care about having their systems compromised. Which "betrayal" is worse -- Skype being able to look at messages, or compromised systems? In terms of implementation, it's interesting to think about the design space.
freewizard 13y ago
Not surprising at all. Skype has been saving chat logs for its China expansion since a few years ago. It's an existing function of their network and probably just a simple switch on their server.
- anonymfus 13y ago
  No, it was reported that Chinese version of Skype spies on client site. If somebody would get international version of Skype in China, it would not spy.
downandout 13y ago
I'm not sure how this or the original article are "discoveries". Per the skype privacy policy, they are receiving and storing just about everything: (from http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa...) Retention of Instant Messages, Voicemail Messages, and Video Messages (Skype internet communications software application only) Your instant messaging (IM), voicemail, and video message content (collectively “messages”) may be stored by Skype (a) to convey and synchronize your messages and (b) to enable you to retrieve the messages and history where possible. Depending on the message type, messages are generally stored by Skype for a maximum of between 30 and 90 days unless otherwise permitted or required by law. This storage facilitates delivery of messages when a user is offline and to help sync messages between user devices... From Section 8 of that same document: Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links. In limited instances, Skype may capture and manually review instant messages or SMS in connection with Spam prevention efforts.
- ballard 13y ago
  The article is fear-mongering with a drip of reality, too much like commercial news. If someone didn't think all of their personal electronic interactions: SMS, gmail (if you still have one), banking info weren't being cursorily evaluated by echelon or other tinfoil hat system ... blackball the moron. I'm interested in by-invite-only HN alternatives w/ lower noise and higher signal. (I'm no longer using HN as a primary news source and refuse to disclose which I do use.)
  - sinnerswing 13y ago
    How about a GMAIL backdoor? oh no!! NOT GOOGLE! Anyone remember this? "A US government-mandated backdoor allowed China to hack into Gmail" "In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access." http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...
GigabyteCoin 13y ago
Why is everybody so worried that Skype is visiting URLs you posted in their chat box? They're probably just checking them for Malware was my first thought and is still my only.
- DannyBee 13y ago
  Because they are sending urls you type in back to MS and MS is storing them? They also claim it's a secure communciations platform. If it was actually secure, why would microsoft be able to see it?
- DannyBee 13y ago
  Because they are sending urls you type in back to MS and MS is storing them? They also claim it's a secure communciations platform. If it was actually secure, why would microsoft be able to see it?
- jlgreco 13y ago
  The concern is more that they are even able to.
- pyre 13y ago
  If the URL is scraped from the message as it passes through Microsoft's servers, then Microsoft's servers have direct access to your chat text (i.e. not an encrypted channel from client-to-client). If the URL is sent from the receiving client to Microsoft for analysis, then Microsoft has a list of all URLs that have been communicated to you via Skype. Either of these scenarios chips away at / tears down the idea that Skype is a 'secure' communications platform.
Nux 13y ago
Like their latest ad on British TV says: "At Microsoft, your privacy is our priority!" :-D
OldSchool 13y ago
Nothing else explains why Microsoft would pay US $8 Billion for Skype. Profit margins are either exactly zero or near-zero for every call; this is not 1995 when telco call termination was 20x more expensive. The simplest explanation is that reliable incumbent Microsoft was hired in some way to conveniently consolidate Skype. With as many channels through which Microsoft does business with the US government, favorable contract terms here and elsewhere could easily make the whole package worthwhile.
- mtgx 13y ago
  NSA was already ready to pay billions of dollars for a Skype eavesdropping solution [1]. One could wonder if that's one way Microsoft wanted to recover some of the cost of their investment, and why they were so willing to pay twice as much as Google wanted to pay. I mean what company outbids another by 2x/$4 billion for a company with not that much revenue and profit? [1] - http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/ http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_...
  - pyre 13y ago
    | One could wonder if that's one way Microsoft | wanted to recover some of the cost of their | investment You could wonder, but it would seem difficult to hide $1 billion in revenue for a publicly traded company.
    - OldSchool 13y ago
      No need to hide anything. An extra billion or two per year going forward would provide a respectable ROI on $8 billion. Surely there are countless wholly open ways to accomplish that with a customer the size of the US gov't.
- teamonkey 13y ago
  > Nothing else explains why Microsoft would pay US $8 Billion for Skype. Really? Nothing else explains why Microsoft wanted to buy talented development staff and software that was becoming the defacto name brand for video communication in homes and businesses, and which was taking market share away from Microsoft's own suite of communications solutions?
bede 13y ago
Has anyone developed a user friendly encryption layer that works on top of Skype? PGP or otherwise. Skype is useful, and it would be nice to have the option to use it for private conversations.
werter03886 13y ago
I tried testing sending a private link to my server to one of my friends over Skype after reading the first Heise article. To get a response from Skype, I contacted them. I think you might find the following very interesting: "You are correct, Skype chats and conversations are encrypted. Your chat can only be read when you sign in using your Skype name and password. Not even Skype or Microsoft has access to your chat history. " You can see the full transcript here: http://pastebin.com/bbiSWtrz http://pastebin.com/bbiSWtrz

345 points by austengary 13y ago

This is totally nit-picky, but strange use of the word "backdoor." When I read "backdoor" I was expecting to read about some malware-like functionality within the Skype client itself, but instead this is just telling us that Microsoft can read content after it is sent to them via the client and decrypted. I would prefer Microsoft stopped scanning/reading my conversations, and I agree that what they're doing (e.g. accessing URLs) is a problem (and arguably illegal, given the recent case about someone accessing insecured AT&T URLs and going to jail). Just think the original title could have been more clear.

oelmekki 13y ago
Seconded. It's more a man in the middle to me. Still a problem, though.
austengary 13y ago
A backdoor in their encryption protocol. They claim it is secure. "The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]" [1]: http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.
- lucb1e 13y ago
  Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...
  - nicheuser 13y ago
    That quote isn't from the policy, it is from a third party audit that was done in 2005.
- drivebyacct2 13y ago
  No. No. No, no, no, no. These are two different things. One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works. Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud. At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers. So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?
  - spellboots 13y ago
    I think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL. It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers. So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.
    - kvb 13y ago
      Or maybe the client forwards the URL to a Microsoft service which accesses it.
      - notdang 13y ago
        If it did this, then it can forward the chat conversation as well
- alfaomega 13y ago
  >Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice. Is it possible that the communication itself is OTR, but the Skype client receiving the message sends only the URLs to the server?
- downandout 13y ago
  The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy. http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa... (this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).
drivebyacct2 13y ago
Besides this hair-on-fire title and intro, this is pretty much just yet another rehashing that Skype visits URLs in chats? (Honestly, if you'd just asked, I would have been assumed this would have been the case anyway)
- mixedbit 13y ago
  You are aware that many popular services allow to share stuff privately using URL encoded credentials?
  - UnoriginalGuy 13y ago
    Indeed. Add this to the 1,000,000 other reasons why you should never use GET requests for authentication/verification.
    - mixedbit 13y ago
      What do you mean by 'using GET requests for verification'? I think you are mixing different concepts. The problem is caused by URL encoded credentials and has nothing to do with GET requests. It is perfectly fine (and often desirable) to authorize GET requests.
      - UnoriginalGuy 13y ago
        You can only encode credentials in a URL via GET. Therefore if people stop using GET and start using POST (aka forms) for authentication this issue goes away. Even just a simple pin. GET issues are primarily related to the fact that an attacker can automate their access. So they could trick a user into going to a specially crafted site, and then request content on that user's behalf via GET forgery, and return it to the web-server you control. It is very convenient, but fairly insecure.
        jrochkind1 13y ago
        you are also ruling out HTTP auth, yes?
ThomPete 13y ago
Isn't it only a problem if they actually use it to identify you. If they just use it the same way that google uses gmail I fail to see the problem.
np422 13y ago
If you provide means for private communication, it's not preferred that it's private - it's a requirement. Gentlemen don't read each others mail.
- tomjen3 13y ago
  Your last statement is so painful, because reality is so far from what it should be.
mtgx 13y ago
Considering there was an article just a few days ago in NYTimes [1] claiming that "Skype is so secure because of its decentralization" that law enforcement tries to pass laws against it, I'd say a lot of people aren't aware that Microsoft does have access to all the information at this point thanks to their "super-nodes", but even NYTimes writers aren't aware of it (or maybe it was just a cloaked advertorial for Skype). I'll also continue to say how extremely disappointed I am that none of the major IM players (not Google, not Apple, not Microsoft, not Yahoo, not Facebook) wants to implement OTR encryption in their chat apps. Google even removed their fake "OTR" from the new Hangouts app, which I believe only hid your logs from yourself, not from Google themselves. [1] - http://www.nytimes.com/2013/05/17/business/concerns-arise-on-us-effort-to-allow-internet-wiretaps.html http://www.nytimes.com/2013/05/17/business/concerns-arise-on...
- Sami_Lehtinen 13y ago
  There are also truly distributed solutions like Bitmessage. https://bitmessage.org/ https://bitmessage.org/
  - johnchristopher 13y ago
    Thank you! I was thinking about MTUA, mail, crypto/privacy and bitsync yesterday and was wondering if there could be a new mail system that would be encrypted and decentralized by default (à la bitsync/bittorrent). Bitmessage seems to closely match what I had in mind.
    - amboar 13y ago
      check out syndie : http://syndie.i2p2.de http://syndie.i2p2.de
- film42 13y ago
  But the whole purpose of the new handouts app is that all clients are syncd. That's kind of hard if 3rd party apps don't have the same ability. Then all you're left with is useless encrypted messages.
- 13y ago
glurgh 13y ago
I don't think it's nitpicky at all - it would be different if Skype, Microsoft or anyone else had actually made a promise that messages that pass through their service are unreadable to them. While it's technically possible it's not the norm and it's hard to come up with examples of services that actually do make this promise - tarsnap is one that comes to mind.
- rbanffy 13y ago
  Readable is one thing. Read and used is a completely different thing.
  - glurgh 13y ago
    Is it? Gmail reads and uses all mail and this doesn't seem to have generated a great outburst of controversy.
    - rbanffy 13y ago
      Yeah, right. While both Skype and Gmail store your messages (if you Skype across multiple devices, you'll see logs of conversations that happened on different devices), I don't think Gmail probes every URL you send in your messages. Also, SMTP is not always done under SSL, so, privacy cannot be assured. But that's easily testable. I'll get back to you in a couple hours.
      - alfaomega 13y ago
        I am struggling to under the distinction you're trying to portray. One automatically scans your email to show related ads, another does a HTTP HEAD request to URLs for only the server headers, which they say is for malware scanning purposes. Both are automated jobs. See my other post to see how Google employees have access to all your email, documents, chat transcripts, Google Voice calls, Youtube videos etc. and how a few abused it to stalk teens. https://news.ycombinator.com/item?id=5728707 https://news.ycombinator.com/item?id=5728707 As usual, Google gets a free pass and Microsoft gets demonized(they should stop claiming it's end to end encrypted, though). Looking at your HN profile, it's not hard to understand why. Thanks for being honest about disliking Microsoft but please try not to let that color your objective opinions and playing favorites regardless of facts.
zerr 13y ago
Yup, title needs to be changed. After reading it, I immediately closed Skype.

RandallBrown 13y ago

That article was nonsensical. English probably isn't their first language, but I have no idea what they're saying.

rdl 13y ago
Indeed, Adam Back's first language is C or Perl I think.
wfn 13y ago
The slang is very common in crypto* newsgroups of these sorts, I didn't find anything unusual or un-parseable in the message.
- vacri 13y ago
  The best I ever saw was when I had a subtle weird issue with a windows graphics driver. The only place I could find on google that looked like it had the answer was a Filipino gamer board... but the only problem was that the thread was a mix of English, Tagalog, and l33tspeak. I could tell that the answer was probably there, but I couldn't interpret it...

Havoc 13y ago

Could someone help me understand why the password changed from "bar" to "yeahright"? Or is that just a mistake on the authors side?

claudius 13y ago
He probably typed out the string in the paragraph and copy-pasted the logs, so likely it is just a mistake on the author’s side.

quackerhacker 13y ago

Don't be surprised. While I can see 2 sides to this argument (it was discussed earlier here on HN, link below), we shouldn't be too surprised by what some companies do to "optimize," their products. Microsoft autocrawling http(s) links could be either for obtaining new bing search results (and it could make that result relative to your conversation), or it could be for security to screen links. I don't know, but I agree that if you have a secret conversation, take steps like PGP to keep it secret. Big Brother is ALWAYS listening :: usually a good preventative security motivation ;) https://news.ycombinator.com/item?id=5721006 https://news.ycombinator.com/item?id=5721006

oelmekki 13y ago

I wouldn't be surprised it this was intended to help bing discover deep web. If it's the case, combine that with the ability on bing to do "ip:<ip>" searches, and you have a formidable tool for forensics.

quackerhacker 13y ago
I agree with this. I know that when I've done webdev and when I check out a unique sandbox url (like jumbled letters with no backlinks) for a page I'll design, I use to see GoogleBot crawl that page eventually in the logs. (guess what browser I was using...Chrome)
- cskau 13y ago
  Chrome has all kinds of services like "resolve navigation error", "URL prediction" and "usage statistics". That Chrome sends your URLs out there on the Internet isn't exactly a secret. If it bothers you, you can disable some of the features under 'Privacy' on: chrome://settings/ The difference here is that Chrome doesn't pretend to be a secure communication channel like Microsoft claims Skype is.

maaaats 13y ago

This is misleading, it's not a backdoor. At least not my definition of backdoor. Anyways, if you need secrecy, don't use a service like this. I have read people speculating if it's for spam/malware protection. They screen the urls to see if it's a redirect to known malware.

deleted 13y ago
[deleted]
burgreblast 13y ago
Agreed. This is one of those "improve the service things". GOOG would do the same, but then sell ads against the data and everyone would say the ads are ok, because they're also operating a free, and very useful service.

buster 13y ago

Very strange article. It only re-does what all other news sources already stated.. plus, i think that commonly a backdoor is understood as something in the software itself that let's someone get access from the outside, which doesn't appear to be the case. Plus, to think that skype would be exempt from the governments claim to get access to all communications and messaging data is very simple-minded. The guy does realize that today governments can access all his mails, right? SSL/TLS or not.

claudius 13y ago
I have reason to believe that the government cannot access all my mails. But if it could, I’d be even happier, as it would either prove a fault in GPG (unlikely) or a working quantum computer implementing e.g. Shor’s algorithm. And who wouldn’t want to hear of the latter?
- buster 13y ago
  I have reason to believe that you're wrong, because if you're under surveillance by the FBI or whatever, they will be able to read your mail. Unless you're the ultra-paranoid guy there are ways to get to your password physically :( (so, since you're coming up with GPG which i obviously was not referring to i can also come up with some unlikely scenario, ok?)
  - GhotiFish 13y ago
    I can't really think of how one gets around that link. I'm not sure what you mean.
    - buster 13y ago
      The point is that noone should act surprised because the laws already demand that communications can be intercepted and read. Of course that excludes GPG (or pasting encrypted text into your skype chat). And that is only true as long as your law enforcement doesn't have you on surveillance. Or unless you can be 100% sure that the NSA really really really can't crack your encryption. And even Bruce Schneier isn't sure about that: https://www.schneier.com/blog/archives/2012/03/can_the_nsa_bre.html https://www.schneier.com/blog/archives/2012/03/can_the_nsa_b...

ksk 13y ago

Have people checked if the client itself sends the URLs separately via some webservice (as opposed to MS being able to decrypt the IM) ?

sp332 13y ago
I have this question too. While still not good, this is the new best-case scenario.

nr0mx 13y ago

This is the company currently running ads positioning itself as a company that holds privacy dear. "At Microsoft, we take our responsibilities for protecting your privacy very seriously. It’s a priority across all our businesses, and an area where we continue to work closely with others throughout academia, government and industry." http://blogs.windows.com/ie/b/ie/archive/2013/04/22/consumer-survey-85-of-americans-are-concerned-about-their-online-privacy-far-fewer-take-action.aspx http://blogs.windows.com/ie/b/ie/archive/2013/04/22/consumer... "Your Privacy is Our Priority" "The lines between public and private may never be perfect, but at Microsoft we are going to keep on trying, because your privacy is our priority." https://www.youtube.com/watch?v=bt51MWll1oY https://www.youtube.com/watch?v=bt51MWll1oY

mtgx 13y ago
That's the most annoying thing about Microsoft's campaigns. Sure they may be slightly better in some areas than Google, but overall they are just as bad, or worse than Google when it comes to privacy. Maybe I'd get it if those campaigns came from Mozilla or DuckDuckGo (even though they are still done in poor taste, and resemble too much negative political campaigns), but Microsoft? I just can't take them seriously in regards to that. Microsoft is throwing stones from a glass house, and they should stop.
- jlgreco 13y ago
  > resemble too much negative political campaigns Seriously, outside of politics they are the most negative ads I've ever seen. Even rival dishsoap or gym ads never get that extreme; nothing else compares. Did they actually hire a political advertising team or something?
  - pyre 13y ago
    IIRC, the Scroogled campaign was put forward by an ex-political campaign guy.
    - jlgreco 13y ago

westoque 13y ago

I guess it's time for Google Hangouts to shine.

nicheuser 13y ago
Why? Google can see everyone you do on them. I don't know why Skype being able to see the URLs is such a huge issue that people are saying they won't use it for business purposes, but at the same time we see people and companies use Google Docs, Google Apps, Gmail which allow Google to see all your business documents, spreadsheets and email. Is this because they think Google is somehow more trustworthy that Microsoft? I am not saying Outlook.com/Skydrive is more secure, but didn't a Google employee get caught reading Gmail information to stalk teens? Atleast Office is primarily used for storing files under your own control, unlike Google docs where you have no choice but to risk Google employees reading them.
alfaomega 13y ago
Why? I don't think it's encrypted in such a way that Google can't read it. References? I don't think you can trust Google with your chat and docs as well. From:http://www.wired.com/threatlevel/2010/09/google-spy/ http://www.wired.com/threatlevel/2010/09/google-spy/ >Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats. >David Barksdale, 27, was fired in July after he reportedly accessed the communications of at least four minors with Google accounts, spying on Google Voice call logs, chat transcripts and contact lists, according to Gawker, which broke the story Wednesday. http://gawker.com/5637234/gcreep-google-engineer-stalked-teens-spied-on-chats http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...
- SilvaR 13y ago
  That actually shows that Google has privacy policies that are to be taken seriously by their own employees
  - alfaomega 13y ago
    Is there anything to show Microsoft does not? All we have here is a server making HEAD requests, not even GET.

X4 13y ago

* Can you please recommend a cross-platform alternative? I only know of Gnome-Empathy/KDE-Telepathy and Pidgin that utilize XMPP's voice and video features. I've found this: http://octro.com/octrotalk.php http://octro.com/octrotalk.php which lacks a linux client, but appears to be solid and has a web-client too.

sparkie 13y ago
https://jitsi.org/ https://jitsi.org/
- X4 13y ago
  I've tried jitsi for some time, but it crashes from time to time. It stores your passwords in cleartext just like pidgin does.
aclevernickname 13y ago
http://yate.null.ro http://yate.null.ro fully replaces Skype functionality (client and server), and works under mac/windows/linux.
- X4 13y ago
  Thanks a lot for sharing! I hope they do more marketing and seo. I didn't find Yate, even after extended web searches. Congrats to the developers, I'll definitely try this one out!

rbanffy 13y ago

What if someone passes an internal (poorly designed) Microsoft REST API that damages something when HEAD is called?

alfaomega 13y ago
Then they fix the bug in the REST API and move on? A HEAD causing damage is a bug.

alfaomega 13y ago

>How far does this go? Do people need to worry about microsoft IIS web servers with SSL, exchange servers? You do have to wonder if apple backdoored their IM client, below the OTR, or silent circle, or the OS - I mean how far does this go? Jon Callas said not apple, that wouldnt be cool, and apple aims for coolness for users; maybe he should dig a little more. What? Why bring Apple into this? >Now are they just hoovering up the skype IMs via the new microsoft central server architecture having back doored skype client to no longer have end2end encrption (and feedind them through echelon or whatever) or is this the client that is reading your IMs and sending selected things to the mothership. Skype claims the changes were unrelated, not sure if believable but they have some details on them here. http://blogs.skype.com/2012/07/26/what-does-skypes-architecture-do-2/#fbid=VKAM4wOskXH http://blogs.skype.com/2012/07/26/what-does-skypes-architect... More interesting details here. http://www.zdnet.com/no-microsoft-and-skype-are-not-playing-big-brother-7000001565/ http://www.zdnet.com/no-microsoft-and-skype-are-not-playing-... >btw their HEAD request was completely ineffective per the weak excuse microsoft offered in the article at top my php contained a meta-refresh which the head wont see as its in the html body Yes, but if the links are spreading fast, you can expect more scrutiny. I think they're trying avoid situations like the below. "New Skype malware spreading at 2,000 clicks per hour to mine Bitcoins" https://news.ycombinator.com/item?id=5502028 https://news.ycombinator.com/item?id=5502028 Interesting comments on that article, including someone calling for Ballmer to be jailed because he allows malware links on Skype. How can they detect and stop malware with OTR?

tete 13y ago

Hey, there is an amazing alternative without setup time, P2P, open, standards compliant, ... And best of all it's a shameless ad for a story submitted by myself. ;) https://news.ycombinator.com/item?id=5729606 https://news.ycombinator.com/item?id=5729606

ancarda 13y ago

The main problem is most of my friends (even those who are programmers) cannot be bothered to spend the 20 minutes picking up alternative software so I'm stuck with Skype and Facebook as my primary means of talking to people.

yarou 13y ago
Convenience for privacy. :)

Bjoern 13y ago

This is yet another reason on my list why I welcome WebRTC so that we can get rid of problems like this.

rossjudson 13y ago

Checking URLs passed in messages isn't incompatible with secure communication. It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them (and verify that they're not pointing to bad stuff, which is a very valuable service to provide to the vast number of readers). We might find somewhere in Skype's ToS a reference to URL checking, for any URLs you send through the service. The URL checks could also be anonymized.

betterunix 13y ago
"Checking URLs passed in messages isn't incompatible with secure communication" I guess that depends on your definition of "security," and perhaps of "practicality." Where I'm from (i.e. a grad student whose research is on practical secure multiparty computation), a practical system for checking URLs in a privacy-preserving fashion is still very much a research topic. "It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them" How is that secure? Now the third party knows what URLs you are sending in your messages. "The URL checks could also be anonymized." Sure, but that is not what you are seeing here. You would need a mix-net of some kind, one in which the users themselves are participating (to ensure that there is at least one honest party). It is technically possible...but you're not going to see it happen, not any time soon. With the FBI talking about building back doors into everything, what incentive is there for a company like Microsoft to actually make such a secure system? When it comes down to it, most Skype users are too uninformed to even know how their software might betray them. On the other hand, the Justice Department could create plenty of difficulty for Microsoft if they failed to cooperate. Whose side do you think Microsoft will choose?
- rossjudson 13y ago
  I'm not arguing that the communications stay theoretically secure. If there's any processing going on, they clearly don't. What I'm saying is that you break the message up into risk and non-risky parts, and the risky parts (URLs) can be treated differently. That different treatment is very valuable to the vast majority of users that don't care about complete security, but do care about having their systems compromised. Which "betrayal" is worse -- Skype being able to look at messages, or compromised systems? In terms of implementation, it's interesting to think about the design space.

freewizard 13y ago

Not surprising at all. Skype has been saving chat logs for its China expansion since a few years ago. It's an existing function of their network and probably just a simple switch on their server.

anonymfus 13y ago
No, it was reported that Chinese version of Skype spies on client site. If somebody would get international version of Skype in China, it would not spy.

downandout 13y ago

I'm not sure how this or the original article are "discoveries". Per the skype privacy policy, they are receiving and storing just about everything: (from http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa...) Retention of Instant Messages, Voicemail Messages, and Video Messages (Skype internet communications software application only) Your instant messaging (IM), voicemail, and video message content (collectively “messages”) may be stored by Skype (a) to convey and synchronize your messages and (b) to enable you to retrieve the messages and history where possible. Depending on the message type, messages are generally stored by Skype for a maximum of between 30 and 90 days unless otherwise permitted or required by law. This storage facilitates delivery of messages when a user is offline and to help sync messages between user devices... From Section 8 of that same document: Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links. In limited instances, Skype may capture and manually review instant messages or SMS in connection with Spam prevention efforts.

ballard 13y ago
The article is fear-mongering with a drip of reality, too much like commercial news. If someone didn't think all of their personal electronic interactions: SMS, gmail (if you still have one), banking info weren't being cursorily evaluated by echelon or other tinfoil hat system ... blackball the moron. I'm interested in by-invite-only HN alternatives w/ lower noise and higher signal. (I'm no longer using HN as a primary news source and refuse to disclose which I do use.)
- sinnerswing 13y ago
  How about a GMAIL backdoor? oh no!! NOT GOOGLE! Anyone remember this? "A US government-mandated backdoor allowed China to hack into Gmail" "In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access." http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...

GigabyteCoin 13y ago

Why is everybody so worried that Skype is visiting URLs you posted in their chat box? They're probably just checking them for Malware was my first thought and is still my only.

DannyBee 13y ago
Because they are sending urls you type in back to MS and MS is storing them? They also claim it's a secure communciations platform. If it was actually secure, why would microsoft be able to see it?
DannyBee 13y ago
Because they are sending urls you type in back to MS and MS is storing them? They also claim it's a secure communciations platform. If it was actually secure, why would microsoft be able to see it?
jlgreco 13y ago
The concern is more that they are even able to.
pyre 13y ago
If the URL is scraped from the message as it passes through Microsoft's servers, then Microsoft's servers have direct access to your chat text (i.e. not an encrypted channel from client-to-client). If the URL is sent from the receiving client to Microsoft for analysis, then Microsoft has a list of all URLs that have been communicated to you via Skype. Either of these scenarios chips away at / tears down the idea that Skype is a 'secure' communications platform.

Nux 13y ago

Like their latest ad on British TV says: "At Microsoft, your privacy is our priority!" :-D

OldSchool 13y ago

Nothing else explains why Microsoft would pay US $8 Billion for Skype. Profit margins are either exactly zero or near-zero for every call; this is not 1995 when telco call termination was 20x more expensive. The simplest explanation is that reliable incumbent Microsoft was hired in some way to conveniently consolidate Skype. With as many channels through which Microsoft does business with the US government, favorable contract terms here and elsewhere could easily make the whole package worthwhile.

mtgx 13y ago
NSA was already ready to pay billions of dollars for a Skype eavesdropping solution [1]. One could wonder if that's one way Microsoft wanted to recover some of the cost of their investment, and why they were so willing to pay twice as much as Google wanted to pay. I mean what company outbids another by 2x/$4 billion for a company with not that much revenue and profit? [1] - http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/ http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_...
- pyre 13y ago
  | One could wonder if that's one way Microsoft | wanted to recover some of the cost of their | investment You could wonder, but it would seem difficult to hide $1 billion in revenue for a publicly traded company.
  - OldSchool 13y ago
    No need to hide anything. An extra billion or two per year going forward would provide a respectable ROI on $8 billion. Surely there are countless wholly open ways to accomplish that with a customer the size of the US gov't.
teamonkey 13y ago
> Nothing else explains why Microsoft would pay US $8 Billion for Skype. Really? Nothing else explains why Microsoft wanted to buy talented development staff and software that was becoming the defacto name brand for video communication in homes and businesses, and which was taking market share away from Microsoft's own suite of communications solutions?

bede 13y ago

Has anyone developed a user friendly encryption layer that works on top of Skype? PGP or otherwise. Skype is useful, and it would be nice to have the option to use it for private conversations.

werter03886 13y ago

I tried testing sending a private link to my server to one of my friends over Skype after reading the first Heise article. To get a response from Skype, I contacted them. I think you might find the following very interesting: "You are correct, Skype chats and conversations are encrypted. Your chat can only be read when you sign in using your Skype name and password. Not even Skype or Microsoft has access to your chat history. " You can see the full transcript here: http://pastebin.com/bbiSWtrz http://pastebin.com/bbiSWtrz