23 ms·

I must have missed the "how" part. And how is the HTTPS link crawling even related?

wmf 13y ago
People like making knee-jerk arguments that the only way Skype could implement anti-phishing is to have no security.
hga 13y ago
The how is replacing ... volunteered ^_^ 3rd party supernodes with company provided ones. There were indeed good business reasons to do this as the Skype item Forbes linked to says, but it also obviously gives Skype complete control.
- wmf 13y ago
  The supernodes are an orthogonal issue. If Skype is end-to-end secure then the location of the supernodes doesn't matter. And if Skype is not end-to-end secure (e.g. imagine if their CA issues MITM certs) then having supernodes in US university dorm rooms doesn't help you either. BTW, if anybody wants a refresher, here's what Skype says their architecture is: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... It could have changed since 2005, although I've heard that really old versions of Skype can still connect to the network.
  - ajross 13y ago
    You're confusing "provable security" with "effective privacy", and they aren't the same thing. Having uncontrolled supernodes certainly does "help you", as it means Skype can't see the traffic without some other exploit to get it. Verbal communication is normally "insecure" and subject to eavesdropping, but if I have the conversation on a boat in the ocean I can be relatively certain that no one else is going to hear it.
    - moheeb 13y ago
      I considered verbal communication as the most secure! I'm curious what would be considered more secure. The only method more secure that I can think of is sign language, but that doesn't translate electronically.
  - MacsHeadroom 13y ago
    It has changed since 2005. It changed dramatically in 2011, just after it was purchased by Microsoft (a PRISM Partner).
  - hga 13y ago
    Pretty old ones can. My father's eyesight is a bit problematic now, and I have him running an old Windows version, perhaps as old 2007 or I think older, because their "New and Improved!" versions at least back then had impossibly small type.
  - deleted 13y ago
    [deleted]
- nobodysfool 13y ago
  Remember when in 2011 May Skype went down for a while (and before that, Vonage, and various other communications providers)? Yea, that was when they added the recording capability. Note that there was no client update, just a mysterious "network outage".
moutarde 13y ago
Skype supports call forwarding which by necessity negates the end to end encryption. It could be that to tap a Skype users calls they modify the users on-line address book to make it appears to their client that all of their contacts have call forwarding set up. All voice data then gets sent to Skype HQ, decrypted and stored, before being forwarded on to the interned recipient.

wmf 13y ago

People like making knee-jerk arguments that the only way Skype could implement anti-phishing is to have no security.

hga 13y ago

The how is replacing ... volunteered ^_^ 3rd party supernodes with company provided ones. There were indeed good business reasons to do this as the Skype item Forbes linked to says, but it also obviously gives Skype complete control.

wmf 13y ago
The supernodes are an orthogonal issue. If Skype is end-to-end secure then the location of the supernodes doesn't matter. And if Skype is not end-to-end secure (e.g. imagine if their CA issues MITM certs) then having supernodes in US university dorm rooms doesn't help you either. BTW, if anybody wants a refresher, here's what Skype says their architecture is: http://www.skype.com/en/security/#encryption http://www.skype.com/en/security/#encryption http://download.skype.com/share/security/2005-031%20security%20evaluation.pdf http://download.skype.com/share/security/2005-031%20security... It could have changed since 2005, although I've heard that really old versions of Skype can still connect to the network.
- ajross 13y ago
  You're confusing "provable security" with "effective privacy", and they aren't the same thing. Having uncontrolled supernodes certainly does "help you", as it means Skype can't see the traffic without some other exploit to get it. Verbal communication is normally "insecure" and subject to eavesdropping, but if I have the conversation on a boat in the ocean I can be relatively certain that no one else is going to hear it.
  - moheeb 13y ago
    I considered verbal communication as the most secure! I'm curious what would be considered more secure. The only method more secure that I can think of is sign language, but that doesn't translate electronically.
- MacsHeadroom 13y ago
  It has changed since 2005. It changed dramatically in 2011, just after it was purchased by Microsoft (a PRISM Partner).
- hga 13y ago
  Pretty old ones can. My father's eyesight is a bit problematic now, and I have him running an old Windows version, perhaps as old 2007 or I think older, because their "New and Improved!" versions at least back then had impossibly small type.
- deleted 13y ago
  [deleted]
nobodysfool 13y ago
Remember when in 2011 May Skype went down for a while (and before that, Vonage, and various other communications providers)? Yea, that was when they added the recording capability. Note that there was no client update, just a mysterious "network outage".

moutarde 13y ago

Skype supports call forwarding which by necessity negates the end to end encryption. It could be that to tap a Skype users calls they modify the users on-line address book to make it appears to their client that all of their contacts have call forwarding set up. All voice data then gets sent to Skype HQ, decrypted and stored, before being forwarded on to the interned recipient.