Skype Security and Privacy Concerns

CDMA_Demo writes "Scott Granneman at Security Focus is discussing the security and privacy issues thanks to eBay's acquisition of Skype. Says the help section on Skypke's website: 'Skype uses AES (Advanced Encryption Standard), also known as Rijndael, which is used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 10⁷⁷ possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates.' Scott Granneman debates that since Skype is owned by eBay and is closed source, we have no way of verifying this claim. Further, from the article: 'At the CyberCrime 2003 conference, Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials: 'I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information.' This raises interesting questions about how Skype and eBay together will try to avert cyber criminals from using security flaws in either system to their advantage.'"

Comments

1.1 x 1077 keys?

[TrevorB]

All that new CSS and no superscripts?

1.1 x 1077 possible keys

[Anm]

I think I can manage to brute force 1185 keys by hand, let alone with a computer. (Guess the tag didn't copy into the text input very well.)

Anm

Re:1.1 x 1077 possible keys

[big.iron.wiz]

With all those keys in your hand, would'nt there be a problem typing the code needed to crack the safe?

Re:1.1 x 1077 possible keys

[mysqlrocks]

How long would it take 50,000 monkeys at 50,000 typewriters to crack this?

OK, that's it

[ObjetDart]

I'm switching back to my regular phone.

Oh, wait...

there is a more interesting question

[toby]

This raises interesting questions about how Skype and eBay together will try to avert cyber criminals from using security flaws in either system to their advantage.

What about "how eBay will try to help over-enthusiastic law enforcement deprive users of privacy"?

Nah. Could never happen in a "freedom" loving country!

Skypke's website

[kherrick]

I love Skypke. I wish everyone used Skypke.