Slashdot Mirror
Microsoft Makes Skype Easier To Monitor
In a follow-up to a story earlier this week, derekmead writes "Skype has gone under a number of updates and upgrades since it was bought by Microsoft last year, mostly in a bid to improve reliability. But according to a report by the Washington Post, Skype has also changed its system to make chat transcripts, as well as users' addresses and credit card numbers, more easily shared with authorities. As we've already seen with Facebook and Twitter, big Internet firms aren't digging their heels in against government requests, which shouldn't come as a shock; angering the authorities is bad business. The lesson then is that, while the Internet will always retain a vestige of its Wild West days, as companies get bigger and bigger, they're either going to play ball with governments or go the way of Kim Dotcom."
sorry, not going to do it.
Time to switch to something where we actually know what the software is doing.
...will this mean "wiretapping" via traditional warrant methods, or warrantless eavesdropping, either by non-warrant request or by essentially giving them the keys to the castle?
If it's traditional warrant methods then I'm not really any more concerned than I am for regular phone calls on POTS lines. If it's otherwise then I'm glad that I never set up a Skype account.
Do not look into laser with remaining eye.
So the people "up to something" will use encryption we cannot monitor, you say? Well, I guess that means that everyone who doesn't use our standard encryption that isn't worth being called encryption is suspicious just for using an encryption method we cannot eavesdrop in.
Thank you for your input, citizen, it will be considered with the next round of new laws.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Umm, how about no thanks? It's time for the programmer community to develop easy to use, robust, strongly encrypted, point to point programs.
And that will happen right after ipv6 becomes standard and NAT goes away. point to point is pretty tricky to make 'just' work in our currented "ipv4 nearly everyone is behind a NAT system".
Realistically, a middle man is going to be here for a long while yet.
This from the TFA:
Skype has gone under a number of updates and upgrades since it was bought by Microsoft last year, mostly in a bid to improve reliability. But according to a killer report by the Washington Post, Skype has also changed its system to make chat transcripts, as well as users’ addresses and credit card numbers, more easily shared with authorities.
The " to make chat transcripts, as well as users’ addresses and credit card numbers, more easily shared with authorities" is pure speculation.
And the alleged updates "since it was bought by Microsoft last year" (supernodes hosted in central data centers) was actually started in 2010, well before the Microsoft acquisition:
http://www.zdnet.com/skype-talks-back-to-critics-on-security-and-privacy-7000001682/
But this is slashdot. Why let facts get in the way of a good rumor-fueled speculation when it promises for a good Microsoft bashing?
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
That will work until the alternative solution crosses a certain threshold of users, the founders sell out to Microsoft or Apple or Google and the new technology is monetized and put under monitoring, just like Skype and Vonage and Napster and Lindows before them. Lather, rinse, repeat.
Will Jitsi let me call home to my old wired phone?
Yes: ...BUT...
Jitzi supports the SIP standard and there are plenty of SIP-to-POTS providers around (for example, I use Switzernet which is based in switzerland and free to/from several european countries. Works with both my SIP sfotwares - Ekiga and Twinkle).
For obvious reasons there's no easy way to guarantee end-to-end encryption. So you *CAN* call home, but you won't get guaranteed privacy.
For full end-to-end encryption you need:
- a digital link from the source to the other end (which is not the case when bridging to POTS)
- the possibility to audit the software used at both ends that there are no bugs or implementation problems which could leak critical data. (So you need an opensource front-end and an opensource encryption layer, preferably using known and well tested and documented protocols (like ZRTP). And you need enough independent eyeballs looking at said code) (Jitzi is opensource so one can check that everything is properly implemented to avoid leaks).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
You dumped your ISP?
I've never tried a ZRTP connection through Tor, but in theory that's most of the necessary parts.
If governments didn't attack Tor exit nodes there would be plenty of bandwidth available for everybody to have this level of privacy.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Skype used to have a pretty impressive peer to peer encryption design. No longer, I guess.
Yes it does. Nothing has changed with the peer-to-peer encryption. You have been fed rumors, speculation. Here is what Skype says (but if you *want* to make it into a conspiracy you can of course assume that they are lying):
Skype software autonomously applies encryption to Skype to Skype calls between computers, smartphones and other mobile devices with the capacity to carry a full version of Skype software as it always has done. This has not changed.
(from http://blogs.skype.com/en/2012/07/what_does_skypes_architecture_do.html)
This is once again someone irresponsibly reading license terms and trying to twist every phrase and condition into something sinister. Like Skype making sure that you understand that instant messages may be stored on the servers because they need to be synchronized with multiple devices which are not all on-line. Like Skype saving voice-messages - because they are (d-oh!) *voice* *messages* (as opposed to peer to peer communication).
For a real take on this read: http://www.zdnet.com/skype-talks-back-to-critics-on-security-and-privacy-7000001682/
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
I'm posting anonymously because I don't need attention. Here's the chronology and you can find the sources of these claims on your own.
- NSA issues a billion dollar RFP asking for a solution to wiretapping Skype
- as years pass, NSA's concerns about Skype keep on growing, they keep on lobbying lawmakers and industry officials
- out of the blue, MS buys Skype and pays an astronomical price
- buying Skype at that price makes no sense for MS since it poisons their relationships with carriers and pundits are confused
- first thing MS does is it kills supernodes and installs THOUSANDS of Linux servers running grsecurity http://grsecurity.net/news.php#Skype
- that means that ALL Skype traffic now passes through MS servers and can be easily wiretapped since MS holds all the keys and can easily perform a MITM attack
- NSA starts jumping from joy because their biggest black hole has been plugged.
- MS is happy because they are now getting regular large checks from NSA
tl;dr: Skype's a botnet and NSA paid MS to buy Skype
I find it quite amusing, that the software that comes from creators of Kazaa, which uses the same P2P methodology that was developed to help people bypass government- and law-restrictions is now being used to spy on people.
If you're going to used Pidgin and custom plugins, what's stopping you from using XMPP instead of Skype?
You're missing the point here, the problem with Skype is that it's perceived as easy to use and it was the first popular one on the market, so it's crazily widespread. I use Jabber with my family, employees and other people whose computers I can control. I use Jabber with some technical people whose computers I do not control. But I gotta use Skype with non-technical people I can't influence about software they use.