Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Skype fixes security vulnerabilities

hub.zhovner.com

Post reply on HN
Print view View original

111–119 of 119 posts

Re: How Skype fixes security vulnerabilities

#111

Post by 120bits »

> Skype tech support is vulnerable to social engineering, and Microsoft is perfectly OK with that.

This is bothers me alot. My mom got a call from this guy pretending to be MS employee couple of weeks ago. He told her that the PC has been infected by virus and MS has been notified and he is helping her to resolve the issue. For a person like my mom who is not much of tech savy person, the chances are really high to fall for this. Fortunately, she told that guy to call her back later, because she didn't know the administrator password.

Re: How Skype fixes security vulnerabilities

#112

Post by mschuster91 »

walrus01 wrote: post #91
mschuster91 wrote: post #62

Earlier quoted context omitted.

The solution is simple: Hire support people - and both train and allow them to deviate from the usual support flowcharts. Oh, and check if they actually speak English well enough to communicate with customers. As a customer, I instantly notice outsourced callcenters.

The solution is not simple, if you're on the business management side and need to concern yourself with the fully loaded yearly office space, overhead, payroll/benefits cost of hiring hundreds of well trained, motivated, educated, english speaking customer support reps to support your 20+ million "free" customers...

It all boils down to classic capitalism: privatizing profits (money not spent on support teams) and socializing losses (wasted police funds on SWATting, often needed psychological care for victims, lost productivity due to hacks)...

Once these losses are factored in, the tide swings towards support staff. But unfortunately that won't happen any time soon.

Re: How Skype fixes security vulnerabilities

#113

Post by setq »

antihero wrote: post #102
setq wrote: post #32

Earlier quoted context omitted.

I've dumped all of these services due to random crap like this. Phone, SMS, email or go away. They're not perfect but they are significantly better than anything else. However if you want a real turd: Skype for Business. Everything starts with 20 minutes trying to work out if it's working or not which for a random subset of people the answer is nope.

Phone and SMS are fucking useless if you spend any significant period of time using wifi without having signal (my office, the tube, etc.), and you have to pay to send images. SMS can go do one, to be honest.

I read books on the tube :)

Re: How Skype fixes security vulnerabilities

#114

Post by FabHK »

mschuster91 wrote: post #62
walrus01 wrote: post #44

Earlier quoted context omitted.

yes, exactly why it's a hard problem to solve.

The solution is simple: Hire support people - and both train and allow them to deviate from the usual support flowcharts. Oh, and check if they actually speak English well enough to communicate with customers. As a customer, I instantly notice outsourced callcenters.

The more latitude and discretion you give them, the more susceptible you'll be to social engineering attacks.

Re: How Skype fixes security vulnerabilities

#115

Post by mixedCase »

mrbiber wrote: post #65
alkonaut wrote: post #16

Earlier quoted context omitted.

This. People talk about various alternatives, but I haven't seen one. The requirements are pretty simple 1) Chat and group chat (persistent) 2) Simple file transfer and image posting in chat 3) Good quality voice calls, video calls and group voice calls 4) Apps for android/iOS with shared contact lists 5) Single application for all of the above (to enable a single group set, switching between group chat and group cal…

Riot.im is almost there, together with e2e crypto, foss stack, server federation and bridges to slack, irc etc.

Riot is a good alternative to IRC, Slack and other team/community chat systems.

It's not an option for the international 1 on 1 most Skype users are used to. The closest option seems to be Wire, but I've yet to try it.

Re: How Skype fixes security vulnerabilities

#117

Post by llumiaho »

raphaelh wrote: post #90
TorKlingberg wrote: post #61

Earlier quoted context omitted.

WebRTC is almost there, and I think in the next few years most such emails will have a link to a WebRTC based service. It is easier than Skype really. Just click a link and it starts a video call. There are jsut a few browser compatibility issues that need sorting out.

The only problem right now is that there's no WebRTC support on iOS :(

You mean in Safari on iOS? Native apps can support WebRTC, like Facebook Messenger does.

Re: How Skype fixes security vulnerabilities

#118

Post by tmikaeld »

zeratax wrote: post #82
marksamman wrote: post #48

I've been looking for a Skype alternative since the security of Skype was weakened after it was acquired by Microsoft. I've had my account stolen multiple times because their support has changed the primary e-mail address of my account, I had to use the same method the social engineers used to get my account back. Since then I've avoided sharing anything slightly sensitive over Skype, as chat history is synced with a…

You should definitely consider the matrix protocol ( https://matrix.org ) that is used with riot ( https://riot.im ). Matrix allows for a complete decentralization and both the the protocol and the client are open source. There are even many other clients as matrix also works with for example weechat. One of it's biggest strength are the support for bridges to other messengers like slack, irc and gitter. I personally…

Both are too difficult for normal people to grasp and have no central id management so you have to copy it manually

Re: How Skype fixes security vulnerabilities

#119

Post by zhovner »

dirtbox wrote: post #105
dirtbox wrote: post #83

Last year I discovered a bug that allowed you to call someone's phone and remotely activate it's camera and mic by disconnecting the call while it was ringing - the target's device would simply call you back as if it were a dropped call. They fixed it, but boy that was a doozy.

Oh god, haha! Someone picked up my original post about it on reddit and wrote an article including my original drawing. http://www.androidpolice.com/2014/12/22/security-hole-skype-... Ed: Oh my word, hundreds of phone, tech and malware blogs picked up on it all over the world. I didn't have a clue.

Wow! Looks pretty the same to remote mic activation on desktop that i found few years ago https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=h...

Skype for Android can receive a call when skype app in backgroud?

Post reply on HN