91–100 of 112 posts
Calling this a backdoor is an extreme measure. I wasn't able to see any working example, nor any responsible disclosure which seems bad. Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point - backdoor or not. This is not a remote exploitable backdoor it seems.
Earlier quoted context omitted.
If Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).
Skype used to be a peer-to-peer application and did not use nor require any "central" servers. Then, Microsoft bought it and that all changed.
The old Skype for Windows was really locked and obfuscated. I remember that it would not even start on my PC with a debugger installed, even though it was not running in the debugger.
Earlier quoted context omitted.
>You mean more paranoid interpretation. honestly it amazes me that people still call such interpretations paranoid in a world where information about the rampancy of such programs is readily available, including for this specific application Edit: it's not paranoia if there's demonstrable history of such things. It's making a reasonable assumption from available facts. further, all the arguments against this interpre…
It seems to me to be a paranoid interpretation because if Microsoft wants to hand Skype-related user data over to the NSA, they'll do so on the server side and not the client side. Secondly, this is a pretty stupid way of doing it. 'If you use this client identifier than anything goes' seems vastly more like a stupid coding mistake than it does a sneaky covert backdoor into accessing Skype from the local machine.
Earlier quoted context omitted.
Does any NSA surveillance vulnerability stand up to logical scrutiny? No, because introducing security vulnerabilities to keep us secure is inherently illogical.
If this comment made sense to someone else who could rephrase it for me, I'd be grateful.
Calling this a backdoor is an extreme measure. I wasn't able to see any working example, nor any responsible disclosure which seems bad. Also, if somebody has the ability to run arbitrary code on your machine, I would think that it's game over at that point - backdoor or not. This is not a remote exploitable backdoor it seems.
Well, let's just look at the source code and we can see when/where it got added.
Sure people who build it from source would be protected, but that's still not the majority of users for a product like Skype. I don't get the OSS cause being shoehorned into every conversation.
Earlier quoted context omitted.
> it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. Well, if you have any of the closed-source companies' software on your system (and by definition, that is +/- 310mio citizens, in the US alone), you are sure to have NSA backdoors on your system. Such backdoors certainly do not require manual intervention for them to be exploited on large scale.
Explain?
I've heard rumors that the Skype codebase is a giant mass of unmaintainable code "approaching a singularity" and for this reason alone you wouldn't expect it to be terribly secure. At one time I wondered if I was too paranoid for adding another user account for the sole purpose of running Skype, but I no longer wonder. That and the fact that OS X security is not fantastic to begin with, and I don't want anything weir…
Earlier quoted context omitted.
If Skype wanted to give user data to the NSA, they would send it over from their servers instead of implementing a backdoor that requires the NSA to already already have software on the target's computer (at which point, assuming they managed to get root, they could circumvent whatever protections Skype was using anyway).
Skype used to be a peer-to-peer application and did not use nor require any "central" servers. Then, Microsoft bought it and that all changed.
While this simple reasoning is appealing, I have to disagree. Both its premises (Skype was peer to peer before MS) and conclusion (MS made it a client-server system because Evil).
- Real peer to peer on internet is not really possible, since most end users are behind NAT. Skype resorts to a number of hole punching techniques, but really only uses STUN/ICE, effectively using super-nodes as relay for sessions. This directly means that all these communication are transiting through a third party, and not peer to peer.
- Super-nodes used to be regular end users (with some simple algorithm to elect as supernode users with high up-time, high throughput. Fun fact: only windows client users were possible super-nodes). This model proved to be too fragile. In case the network falls down (which happened some years ago), then the super-nodes are no longer available, and get instantly DoS when coming back up due to every other node trying to get back. This is a vicious cycle in which the network cannot get back up. So for a long time now (before MS) super-nodes are just backed by Skype-hosted servers in data-centers.
- Thin clients are a real thing in e.g. the african market, where a lot of very old phones are still in circulation, no "apps" are possible. Think of your old Nokia 3310.
- Persistent group chats. Users wanted it.
- And on a more "political" aspect: MS needed to promote its cloud infrastructure (Azure), lower its physical resources fingerprint (get rid of Skype datacenters), and unify its technical stack (Linux/C++ now Windows/C#)