3 ms·

A backdoor in their encryption protocol. They claim it is secure. "The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encry

A backdoor in their encryption protocol. They claim it is secure. "The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]" [1]: http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.

lucb1e 13y ago
Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...
- nicheuser 13y ago
  That quote isn't from the policy, it is from a third party audit that was done in 2005.
drivebyacct2 13y ago
No. No. No, no, no, no. These are two different things. One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works. Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud. At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers. So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?
- spellboots 13y ago
  I think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL. It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers. So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.
  - kvb 13y ago
    Or maybe the client forwards the URL to a Microsoft service which accesses it.
    - notdang 13y ago
      If it did this, then it can forward the chat conversation as well
      - BadCRC 13y ago
        but the linked page doesn't prove that it is.
        MrBra 13y ago
        You would only get a real proof if it was open source.
      - MrBra 13y ago
        Exactly... ..for those who didn't get it yet, that's the main point in all this worrying about the presence of a backdoor in Skype.
alfaomega 13y ago
>Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice. Is it possible that the communication itself is OTR, but the Skype client receiving the message sends only the URLs to the server?
downandout 13y ago
The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy. http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa... (this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).

lucb1e 13y ago

Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...

nicheuser 13y ago
That quote isn't from the policy, it is from a third party audit that was done in 2005.

drivebyacct2 13y ago

No. No. No, no, no, no. These are two different things. One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works. Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud. At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers. So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?

spellboots 13y ago
I think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL. It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers. So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.
- kvb 13y ago
  Or maybe the client forwards the URL to a Microsoft service which accesses it.
  - notdang 13y ago
    If it did this, then it can forward the chat conversation as well
    - BadCRC 13y ago
      but the linked page doesn't prove that it is.
      - MrBra 13y ago
        You would only get a real proof if it was open source.
    - MrBra 13y ago
      Exactly... ..for those who didn't get it yet, that's the main point in all this worrying about the presence of a backdoor in Skype.

alfaomega 13y ago

>Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice. Is it possible that the communication itself is OTR, but the Skype client receiving the message sends only the URLs to the server?

downandout 13y ago

The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy. http://www.skype.com/en/legal/privacy/#retentionOfPersonalData http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa... (this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).