6 ms·
This is totally nit-picky, but strange use of the word "backdoor." When I read "backdoor" I was expecting to read about some malware-like functionality within t
by UnoriginalGuy 13y ago
This is totally nit-picky, but strange use of the word "backdoor." When I read "backdoor" I was expecting to read about some malware-like functionality within the Skype client itself, but instead this is just telling us that Microsoft can read content after it is sent to them via the client and decrypted.
I would prefer Microsoft stopped scanning/reading my conversations, and I agree that what they're doing (e.g. accessing URLs) is a problem (and arguably illegal, given the recent case about someone accessing insecured AT&T URLs and going to jail).
Just think the original title could have been more clear.
- oelmekki 13y agoSeconded. It's more a man in the middle to me. Still a problem, though.
- austengary 13y agoA backdoor in their encryption protocol. They claim it is secure. "The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]" [1]: http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.
- lucb1e 13y agoOh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...
- nicheuser 13y agoThat quote isn't from the policy, it is from a third party audit that was done in 2005.
- drivebyacct2 13y agoNo. No. No, no, no, no. These are two different things. One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works. Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud. At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers. So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?
- spellboots 13y agoI think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL. It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers. So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.
- alfaomega 13y ago>Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice. Is it possible that the communication itself is OTR, but the Skype client receiving the message sends only the URLs to the server?
- downandout 13y agoThe document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy. http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa... (this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).
- drivebyacct2 13y agoBesides this hair-on-fire title and intro, this is pretty much just yet another rehashing that Skype visits URLs in chats? (Honestly, if you'd just asked, I would have been assumed this would have been the case anyway)
- mixedbit 13y agoYou are aware that many popular services allow to share stuff privately using URL encoded credentials?
- UnoriginalGuy 13y agoIndeed. Add this to the 1,000,000 other reasons why you should never use GET requests for authentication/verification.
- mixedbit 13y agoWhat do you mean by 'using GET requests for verification'? I think you are mixing different concepts. The problem is caused by URL encoded credentials and has nothing to do with GET requests. It is perfectly fine (and often desirable) to authorize GET requests.
- UnoriginalGuy 13y agoYou can only encode credentials in a URL via GET. Therefore if people stop using GET and start using POST (aka forms) for authentication this issue goes away. Even just a simple pin. GET issues are primarily related to the fact that an attacker can automate their access. So they could trick a user into going to a specially crafted site, and then request content on that user's behalf via GET forgery, and return it to the web-server you control. It is very convenient, but fairly insecure.
- jrochkind1 13y agoyou are also ruling out HTTP auth, yes?
- ThomPete 13y agoIsn't it only a problem if they actually use it to identify you. If they just use it the same way that google uses gmail I fail to see the problem.
- np422 13y agoIf you provide means for private communication, it's not preferred that it's private - it's a requirement. Gentlemen don't read each others mail.
- tomjen3 13y agoYour last statement is so painful, because reality is so far from what it should be.
- mtgx 13y agoConsidering there was an article just a few days ago in NYTimes [1] claiming that "Skype is so secure because of its decentralization" that law enforcement tries to pass laws against it, I'd say a lot of people aren't aware that Microsoft does have access to all the information at this point thanks to their "super-nodes", but even NYTimes writers aren't aware of it (or maybe it was just a cloaked advertorial for Skype). I'll also continue to say how extremely disappointed I am that none of the major IM players (not Google, not Apple, not Microsoft, not Yahoo, not Facebook) wants to implement OTR encryption in their chat apps. Google even removed their fake "OTR" from the new Hangouts app, which I believe only hid your logs from yourself, not from Google themselves. [1] - http://www.nytimes.com/2013/05/17/business/concerns-arise-on-us-effort-to-allow-internet-wiretaps.html http://www.nytimes.com/2013/05/17/business/concerns-arise-on...
- Sami_Lehtinen 13y agoThere are also truly distributed solutions like Bitmessage. https://bitmessage.org/ https://bitmessage.org/
- johnchristopher 13y agoThank you! I was thinking about MTUA, mail, crypto/privacy and bitsync yesterday and was wondering if there could be a new mail system that would be encrypted and decentralized by default (à la bitsync/bittorrent). Bitmessage seems to closely match what I had in mind.
- amboar 13y agocheck out syndie : http://syndie.i2p2.de http://syndie.i2p2.de
- film42 13y agoBut the whole purpose of the new handouts app is that all clients are syncd. That's kind of hard if 3rd party apps don't have the same ability. Then all you're left with is useless encrypted messages.
- 13y ago
- glurgh 13y agoI don't think it's nitpicky at all - it would be different if Skype, Microsoft or anyone else had actually made a promise that messages that pass through their service are unreadable to them. While it's technically possible it's not the norm and it's hard to come up with examples of services that actually do make this promise - tarsnap is one that comes to mind.
- rbanffy 13y agoReadable is one thing. Read and used is a completely different thing.
- glurgh 13y agoIs it? Gmail reads and uses all mail and this doesn't seem to have generated a great outburst of controversy.
- rbanffy 13y agoYeah, right. While both Skype and Gmail store your messages (if you Skype across multiple devices, you'll see logs of conversations that happened on different devices), I don't think Gmail probes every URL you send in your messages. Also, SMTP is not always done under SSL, so, privacy cannot be assured. But that's easily testable. I'll get back to you in a couple hours.
- alfaomega 13y agoI am struggling to under the distinction you're trying to portray. One automatically scans your email to show related ads, another does a HTTP HEAD request to URLs for only the server headers, which they say is for malware scanning purposes. Both are automated jobs. See my other post to see how Google employees have access to all your email, documents, chat transcripts, Google Voice calls, Youtube videos etc. and how a few abused it to stalk teens. https://news.ycombinator.com/item?id=5728707 https://news.ycombinator.com/item?id=5728707 As usual, Google gets a free pass and Microsoft gets demonized(they should stop claiming it's end to end encrypted, though). Looking at your HN profile, it's not hard to understand why. Thanks for being honest about disliking Microsoft but please try not to let that color your objective opinions and playing favorites regardless of facts.
- zerr 13y agoYup, title needs to be changed. After reading it, I immediately closed Skype.