Slashdot Mirror
Ask Slashdot: Are There Secure Alternatives To Skype? (theguardian.com)
How can you make a truly secure phone call? An anonymous Slashdot reader writes:
I have a Windows 8.1 phone and mostly use it for Skype calls and chats. A bit of browsing every now and then, and checking public transportation schedules... What can I do to be able to securely chat and place audio/video calls? What do you think is the best device to buy and what apps to use on it?
Skype for Windows Phone will stop working in 2017, and Skype's privacy was already suspect after Edward Snowden leaked evidence of Microsoft's secret collaboration with the NSA. But are there any good alternatives -- especially for a Windows Phone user? Leave your suggestions in the comments. What are the best secure alternatives to Skype?
Skype for Windows Phone will stop working in 2017, and Skype's privacy was already suspect after Edward Snowden leaked evidence of Microsoft's secret collaboration with the NSA. But are there any good alternatives -- especially for a Windows Phone user? Leave your suggestions in the comments. What are the best secure alternatives to Skype?
Tox is a alternative, no sure if it is ported to windows phone...
https://ring.cx/
Options are plenty. But the point is how you can persuade all your contacts to switch to the niche app of your choice with you.
Signal is open source. Use Signal if you want real security.
WhatsApp is closed source but uses the same encryption in Signal. Use it if you need something people already use.
In either case, turn on security notifications and learn what they mean, and verify your contacts by reading out their fingerprint over the voice connection.
Telegram's encryption is kinda broken. Therema's encryption is broken. iMessage only works on iOS and it's slightly broken. I donno if Allo does voice, but you must turn on encryption manually, so it's probably broken if you imagine the user can be tricked.
Electroic Freedom Foundation created the Secure Messaging Scorecard to help answer this question. The biggest problem with this scorecard is it mixes desktop and mobile apps together without really indicating which type of app they are. But both Signal and Silent Phone are available for Android and iOS. Either of these might be worth considering as alternatives for the types of things you current use Skype for today.
You mention the need for "secure chat", but don't express "how secure" you would like that to be. As others have posted, if you're connected to the internet (and your question is worded to imply that you're looking at Voice Over IP (VOIP) solutions, then there is pretty much no secure option out there... An Agency like the NSA could record all your data packets and brute-force them pretty quickly, if they so chose.
;)
Having said that, it might be possible for us to brainstorm the sort of attributes that would help to make your VOIP calls less insecure. The collective wisdom of slashdotters might then be able to suggest some alternative products for you to consider. Things to look out for might include:-
1. A solution that uses a central server only for the purpose of establishing the IP address of your chosen call recipient, then allows all communication to that recipient to happen directly, point-to-point. There is no need to route call traffic through central servers (unless you want to listen in). Ahem. Skype.
2. A solution that not only uses the latest approved encryption algorithms, but which makes the swapping of an algorithm a relatively easy process [think user-selectable option, addition of a library file with the algorithm code]. The upgrading of key strength/entropy parameters should be even easier...
3. A solution that includes, within the encryption stream, random white noise padding (to make it much harder to determine the precise amount of data being exchanged) might be nice.
And so on...
I did think about including an option that said, "For each legitimate call channel that you set up using the central register of logged-in users, pick three more logged in users at random and simultaneously exchanged random, encrypted data packets with those users too." Unfortunately, there are multiple issues with that. First, what if one of those random users really was under surveillance by a three-letter-agency. Using the "association" rules, that agency would then start monitoring you *real* closely... and second, running four calls for the cost of one might actually degrade your network/audio performance if you happen to be on a slow link.
Bottom line; there is no easy answer to your question, but please don't consider using Skype and "secure" in the same statement...
You are kidding, right? WeChat is owned by Tencent which has tight connection to te Chinese government. It's worse then Skype in terms of security
Tencent? Pffft!
Let us know when 50 Cent releases his own videochat client.
If we could not ask the same questions every month, that would be great.
WeChat is a Tencent product, and Tencent is partially state-owned by the People's Republic of China. So I can guarantee you that anything you do in that program - in fact, probably anything you do in any device with that program installed, or any device linked to your WeChat profile with social media or other links - is going straight to a national surveillance agency. Just not an American one.
That being the case, I have to seriously question the credibility of anybody suggesting WeChat in the context of basically anything.
WebRTC-based services, in the form of e.g. https://meet.jit.si/, are end-to-end secure and decentralised. Not sure if Windows Phone has any browser which supports WebRTC, though.
If you run Windows Phone or Windows 10 you should say goodbye to any sort of privacy.
https://www.gnu.org/proprietar...
As of now there are no commercially available smart phones that respect your freedom entirely. Depending on where you draw the line,
your best bets are Replicant or at the very least CyanogenMod without any Google Apps.
F-Droid is a package manager for Android that only contains software that respects your freedom.
Why are you people so obsessed with privacy from the government?
Because we don't fucking trust you, shithead. Haven't you figured that out yet?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
As soon as you involve the phone-system, you are compromised. However, you can have a secure voice-chat, with numerous technologies. If you run your own server, something like mumble may serve. Needs a dedicated client, but security is apparently pretty good. Works on Linux.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Use a Web site to set up a WebRTC peer-to-peer session. I like talky.io, which uses peer-to-peer for one-to-one chats. There are many others, and if you don't like them or don't trust them, you could pretty easily build your own.
The security properties of peer-to-peer WebRTC are pretty good:
-- end-to-end DTLS with perfect forward secrecy
-- all protocols involved are IETF standards and have had a decent amount of public security review
-- Firefox/Chromium implementations are fully open source that you can build yourself and run on Windows/Mac/Linux/Android
-- the Web site that sets up the connection could MITM you, but there are many WebRTC sites to choose from and it's pretty easy for anyone to set up more.
I kinda wonder why governments aren't complaining about WebRTC. It's probably just not popular enough yet.
You've got that the wrong way around. The question you should be asking is "Why is the government so paranoid about terrorism?"
Take off the tin foil hat and stop being so paranoid about terrorists, you anti-American, freedom-hating douchebag.
99 problems but a web chat client aint one.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
Terrorism? Is there any single evidence NSA is achieving anything against terrorism? The only evidence we have of their work is that they spy the european MEPs, the european leaders, 56 millions germans, 48 millions italians, 50 millions of french... And the only warning france got before of bataclan came from Algerian services, which are doing mostly Humint....
All terrorists have to do to surprise us again is attack us with a new technique. While the three-letter agencies are making our lives miserable at airports, one jogger tossing a vial of hacked Ebola into a big-city reservoir could be the next 9/11.
Signal is currently the best solution for secure messages and phone calls. It's an app for Android and iOS, and Chrome has an extension to sync your messages to a desktop chat. But it communicates between phone numbers of course, so if that's not what you want then it's a bit trickier.
The best totally anonymous desktop messaging protocol I am aware of is Pidgin (Windows, Linux) and Adium (macOS) using the "Off-The-Record" extension. I don't know if there's any good solutions for video chat.
It's not even that we don't trust,
we absolutely trust that if we allow the agents of government a great power to use in a narrow context, against a specific group of bad actors for the general benefit, that they will eventually without fail use that power in contexts never intended and against people never imagined, with only in regard to the benefit of the few power brokers.
Apocalypse Cancelled, Sorry, No Ticket Refunds
You are kidding, right? WeChat is owned by Tencent which has tight connection to te Chinese government. It's worse then Skype in terms of security
The original poster said security of any of them is a joke. That being said, the question that needs to be asked is who are are you trying to be secure from? If you're a drug dealer in the USA then having a secure client controlled by a country who is not likely to share with your local government is probably not a bad solution. The chinese government is not going to be too concerned about domestic crimes in the USA. Personally, if I was worried about security, I would opt for fragmenting my communication over multiple channels. It's much harder to intercept communication if you email an encrypted video to someone and then text them the encryption key via a burner phone. Even unencrypted, if the message is fragmented over 4-5 distinct channels then piecing it back together becomes much more difficult because you first must gain access to all the different channels. For the average person though, your best bet for a single channel is still probably to not look for the most secure solution but instead look for the most secure solution by a party in opposition to who you want to be secure from.
This assumes that the CIA hasn't already hacked these Chinese services, for no reason other that being a Chinese communications service, especially when there are certain to be Chinese government-mandated back-doors already in place just waiting to be exploited by the CIA.
This is part of the argument against mandating encryption back-doors in the US, that goes beyond US spying: if you build a back-door for someone, eventually someone else will find it.
"the enemy of my enemy is my friend" doesn't work when your new 'friend' is already their own worst enemy.
I think it's funny how people seem to think that being anonymous is important while simultaneously being pissed off that the government doesn't do enough to "deter cheating" of the voting system, legality of immigration status. In short, MY privacy is IMPORTANT, but YOUR privacy is not!
Even more amusing is that they all seem to have no problems with private companies hoarding all of this data. We have no Constitutional protections against private entities. Google and Facebook are far more powerful than the NSA, FBI, and DEA combined. But let's not draw any attention to that, shall we? Let's all focus on how the EVIL GUBMINT is STORIN' DATA ON ME!
Let's pay no attention to the fact that the things you post on social networking or the Internet in general, or the stuff you buy, can be used to build a profile of you that not only controls how much money you're going to spend on something (interest rates), but also whether or not you're hirable at all. You know, things that are truly important to like 99.99% of anyone in the country, earning money and buying goods and services with their money.