Hacker News Reader

Comment by tlrobinson | Hacker News Reader

I must have missed the "how" part.

And how is the HTTPS link crawling even related?

Skype supports call forwarding which by necessity negates the end to end encryption. It could be that to tap a Skype users calls they modify the users on-line address book to make it appears to their client that all of their contacts have call forwarding set up. All voice data then gets sent to Skype HQ, decrypted and stored, before being forwarded on to the interned recipient.

People like making knee-jerk arguments that the only way Skype could implement anti-phishing is to have no security.

The how is replacing ... volunteered ^_^ 3rd party supernodes with company provided ones. There were indeed good business reasons to do this as the Skype item Forbes linked to says, but it also obviously gives Skype complete control.

The supernodes are an orthogonal issue. If Skype is end-to-end secure then the location of the supernodes doesn't matter. And if Skype is not end-to-end secure (e.g. imagine if their CA issues MITM certs) then having supernodes in US university dorm rooms doesn't help you either.

BTW, if anybody wants a refresher, here's what Skype says their architecture is: http://www.skype.com/en/security/#encryption http://download.skype.com/share/security/2005-031%20security... It could have changed since 2005, although I've heard that really old versions of Skype can still connect to the network.

You're confusing "provable security" with "effective privacy", and they aren't the same thing.

Having uncontrolled supernodes certainly does "help you", as it means Skype can't see the traffic without some other exploit to get it. Verbal communication is normally "insecure" and subject to eavesdropping, but if I have the conversation on a boat in the ocean I can be relatively certain that no one else is going to hear it.

I considered verbal communication as the most secure! I'm curious what would be considered more secure. The only method more secure that I can think of is sign language, but that doesn't translate electronically.

It has changed since 2005.

It changed dramatically in 2011, just after it was purchased by Microsoft (a PRISM Partner).

Pretty old ones can. My father's eyesight is a bit problematic now, and I have him running an old Windows version, perhaps as old 2007 or I think older, because their "New and Improved!" versions at least back then had impossibly small type.

Remember when in 2011 May Skype went down for a while (and before that, Vonage, and various other communications providers)? Yea, that was when they added the recording capability. Note that there was no client update, just a mysterious "network outage".

Reply on news.ycombinator.com