4 ms·

You're both talking about two different topics... The location of the "supernodes" (on client machines, or in a datacenter) is separate from whether encrypted

by tjohns 13y ago

You're both talking about two different topics... The location of the "supernodes" (on client machines, or in a datacenter) is separate from whether encrypted traffic can be read by a third party. Using a totally decentralized system makes it a little harder to eavesdrop, but it's entirely possible to develop a completely secure system in the centralized model. That said, I've never been terribly impressed with Skype's security model. Even before Microsoft bought them. It might have been decentralized, and the traffic might be encrypted, but the encryption lacks a strong trust model. There's never been any way to make sure that your connection hasn't been MITM'ed, since the system doesn't provide any way to verify the identity (key fingerprint) of the person you're talking to. The current encryption is fine if you're worried about rogue network administrators, but has never been sufficient if you're worried about being targeted by state actors.

pwnna 13y ago
I understand the concept of having a secure centralized network. I'm interested in attempting to learn about such one myself (and perhaps one day contribute or implement one). It just seem like the original comment said that security is totally fine now, which I feel like is incorrect. For Skype's security model, I thought that before MS bought them they had E2E encryption (sure, it can be MITM'ed, but the conversation's that's not MITM'ed cannot be decoded easily, whereas they could be now). (Is it fair to say that I verify _some_, not all, of my friends' identity via the way the talk? I feel like if I have E2E encryption, I would be fine as a MITM would have a pretty difficult time faking how some of my friends talk.)
- jtheory 13y ago
  MitM doesn't involve anyone faking how your friends talk -- it's always just passing your actual packets back and forth, but recording them first. E2E encryption is only as secure as the key exchange, so if the central Skype server gives you and your friend the keys you need to encrypt/decrypt then just passes along your E2E-encrypted packets... anyone who was able to snag the keys and has access to the encrypted packets can decrypt everything just as you can.
  - pwnna 13y ago
    Yeah, I realized that immediately after I posted.
- wmf 13y ago
  ...before MS bought them they had E2E encryption... Is there any evidence that they removed E2E crypto for voice calls? People keep saying this but their reason seems to be "because MS".
  - drivebyacct2 13y ago
    Not a single drop (that I've seen, and I'm a sucker for clicking on all the Skype-fud-bait links)

by tjohns 13y ago

pwnna 13y ago

I understand the concept of having a secure centralized network. I'm interested in attempting to learn about such one myself (and perhaps one day contribute or implement one). It just seem like the original comment said that security is totally fine now, which I feel like is incorrect. For Skype's security model, I thought that before MS bought them they had E2E encryption (sure, it can be MITM'ed, but the conversation's that's not MITM'ed cannot be decoded easily, whereas they could be now). (Is it fair to say that I verify _some_, not all, of my friends' identity via the way the talk? I feel like if I have E2E encryption, I would be fine as a MITM would have a pretty difficult time faking how some of my friends talk.)

jtheory 13y ago
MitM doesn't involve anyone faking how your friends talk -- it's always just passing your actual packets back and forth, but recording them first. E2E encryption is only as secure as the key exchange, so if the central Skype server gives you and your friend the keys you need to encrypt/decrypt then just passes along your E2E-encrypted packets... anyone who was able to snag the keys and has access to the encrypted packets can decrypt everything just as you can.
- pwnna 13y ago
  Yeah, I realized that immediately after I posted.
wmf 13y ago
...before MS bought them they had E2E encryption... Is there any evidence that they removed E2E crypto for voice calls? People keep saying this but their reason seems to be "because MS".
- drivebyacct2 13y ago
  Not a single drop (that I've seen, and I'm a sucker for clicking on all the Skype-fud-bait links)