It is obvious for me that Satya Nadella never uses Skype (or Lync, cough cough, Skype for Business). If he were using Skype he would write an e-mail like this Bill Gates rant: http://blog.seattlepi.com/microsoft/2008/06/24/full-text-an-... about Movie Maker.
How Skype fixes security vulnerabilities
51–60 of 119 posts
Re: How Skype fixes security vulnerabilities
#52Earlier quoted context omitted.
The support guy sure sounds like an ass... With that said, is your Skype account linked to a Microsoft live account? In that case thats were your contacts should be now.
My account is connected to a Microsoft account, but I can no longer authenticate with my Skype credentials, I can only connect with my Microsoft account now. But it's the same account, the Skype ID is still there. Or in other words, if I indicate my Skype ID as the username in the auth dialog, they now expect my Microsoft password, not my old Skype password (I have unique passwords everywhere). If you have any idea o…
[deleted]
Re: How Skype fixes security vulnerabilities
#53Earlier quoted context omitted.
If I were setting up an automated abuse-report-receiving system that could automatically disable accounts, I would run some sort of filter for "is the account reporting the abuse itself a newly created account, and/or one with suspiciously low and non-human looking usage patterns?". But on the other side, malicious actors can solve that problem by having clickfarm workers in bangladesh create 30 fake facebook account…
One can require the account before many years old before having much weighting. Also, require verified phone number by sms or a verified non prepaid credit card. Allow the user to use your site without that stuff, but restrict actions that spammers like to requiring it.
Requiring phone number or credit card is an extremely effective way to have a large class of (legitimate) users nope out of your service
Re: How Skype fixes security vulnerabilities
#54Earlier quoted context omitted.
This. People talk about various alternatives, but I haven't seen one. The requirements are pretty simple 1) Chat and group chat (persistent) 2) Simple file transfer and image posting in chat 3) Good quality voice calls, video calls and group voice calls 4) Apps for android/iOS with shared contact lists 5) Single application for all of the above (to enable a single group set, switching between group chat and group cal…
I switched to Wire a year ago and haven't looked back. It meets all your requirements, and has end-to-end encryption (based on Signal Protocol) too.
I tried to use Wire with Zhovner (the author of this article) and it consumed 2 full CPU power for a simple voice call. My laptop heated up to 83°C, Zhovner's laptop was also hot.
That's pretty strange since Wire has only interface written in javascript, all the core things are in Rust.
Re: How Skype fixes security vulnerabilities
#55Sadly, Skype is still used a lot. More than half of the emails I receive with a next step of communication proposal come suggesting Skype. The only way to beat it would be to have another communication solution which can be used as simple as Skype is (for any age, technical literacy, etc.).
This. People talk about various alternatives, but I haven't seen one. The requirements are pretty simple 1) Chat and group chat (persistent) 2) Simple file transfer and image posting in chat 3) Good quality voice calls, video calls and group voice calls 4) Apps for android/iOS with shared contact lists 5) Single application for all of the above (to enable a single group set, switching between group chat and group cal…
Discord lacks video calls I think, but it's good enough that it's displaced all the alternatives for me.
Re: How Skype fixes security vulnerabilities
#56Last week Skype dropped 2/3 of my contacts list. I contacted their chat support to tell them about it. The person on the other end was insisting that I might be using another Skype account where my other contacts are. Which of course I ain't since I'm not that stupid. He then suggested the stupid bullshit Tier 1 support usually does, like reinstalling Skype. I did as asked. Then he asked me for remote control of my P…
[deleted]
Re: How Skype fixes security vulnerabilities
#57Last week Skype dropped 2/3 of my contacts list. I contacted their chat support to tell them about it. The person on the other end was insisting that I might be using another Skype account where my other contacts are. Which of course I ain't since I'm not that stupid. He then suggested the stupid bullshit Tier 1 support usually does, like reinstalling Skype. I did as asked. Then he asked me for remote control of my P…
For all who read this and wonder about their own backup before something strange happens, backing up the contacts from the Skype is easy:
Contacts / Advanced / Backup Contacts to File
Consider doing this if you also find that "losing contacts is unacceptable."
There's, of course, also "Restore Contacts from File."
Re: How Skype fixes security vulnerabilities
#58Earlier quoted context omitted.
This. People talk about various alternatives, but I haven't seen one. The requirements are pretty simple 1) Chat and group chat (persistent) 2) Simple file transfer and image posting in chat 3) Good quality voice calls, video calls and group voice calls 4) Apps for android/iOS with shared contact lists 5) Single application for all of the above (to enable a single group set, switching between group chat and group cal…
Discord does most of this. I've entirely moved to using it for voice comms with people where I'm suggesting the platform. It's guest support is pretty robust, so just fire someone a link and they can dial in from their browser if they don't have the app. Call quality is better than Skype, there's separate persistent chat rooms too. I like it a lot.
I like Discord, but their interface leaves a lot to be desired. Their sign out button is hidden away, and I wouldn't have found it if it wasn't for this article: https://support.discordapp.com/hc/en-us/articles/209572128-H...
Re: How Skype fixes security vulnerabilities
#59I don't think I can fault Skype for this "vulnerability" - the problem itself isn't really in code, but in people. Yes, within the article there's mention of a past attack which relied on socially engineering a support specialist to send verification codes and guess the result, but that seems to have stopped. I'd actually love to know the key generation algorithm or the probabilities that go into guessing one of four-ish codes sent in a burst in just a few tries.
Still. the other exploit mentioned, the one not "patched" - This same kind of mass-reporting system exploit is usable in all manner of online forums and services - heck, HN's own flag feature could get pretty close (we just have some very hands-on moderators and an okay community)!
As for not restoring something when contacting support... I can understand why. It's _better_ this way, since then no malicious party who is _actually_ spamming with Skype accounts can retrieve an account using only a bit of social engineering! Instead they need to roll up new emails and new accounts. (And think of it this way: If a malicious party is abusing the system to get your account blocked, how will they know your new account to repeat the procedure? They shouldn't.)
Yes. It's a pity that the abuse reporting system is itself vulnerable to abuse, but... aren't most? Given Skype's massive userbase, putting the user reporting function behind a mechanical turk... the rate at which they'd need to comb through ban requests would seem to make fatigue (and thereby false positives which would result in the same outcome as now) inevitable. The only interesting way I've seen this abuse-system abuse handled in recent years was the League of Legends tribunal system[1], where they effectively handed penalty decisions to the community at large and let them come to a consensus. Though I don't know how well it worked and, honestly, that system seems just as game-able as the automated report button itself. In fact, it feels analogous to a Sybil attack[2] in the crypto world - get enough aligned malicious identities in a decentralized system and they effectively control it. The only "fix" is making identity creation too expensive to make gaining a controlling share of the identity-space prohibitive (which would entail making account creation difficult) - I feel that this is _directly at odds_ with account creation speed and this user acquisition for a service like this, so I can not fault Skype for falling on the middleground that they have.
[1]http://forums.na.leagueoflegends.com/board/showthread.php?t=... [2]https://en.wikipedia.org/wiki/Sybil_attack
Re: How Skype fixes security vulnerabilities
#60Skype makes me sad.
I used it 10 years ago, and it was great - or at least pretty good, compared to the other options. Video calls, screen sharing, chat.
But it had a number of problems. Mostly surrounding using it on multiple devices, making it very hard to keep track of what has and has not been read. Log onto Skype on a device I have not used in a couple of days, and "unread" messages show up - messages I have already read.
Over the past 10 years, none of the issues that I care about have been addressed. But we did get some garbage integration with facebook and nice emoticons. They added features nobody wants and have not addressed the problems. It is maddening.
It makes me sad. But it is unfortunately still the standard when you deal with non-technical people, so I keep using it... :(