Live data from Hacker News

Signal partners with Microsoft to bring end-to-end encryption to Skype

signal.org

221–230 of 350 posts

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#221
post #203

Earlier quoted context omitted.

No. They're not useful. They were a disaster, and EFF should stop doing them (I think they have?) https://news.ycombinator.com/item?id=10525266

Seems like there's a demand for an objective layman friendly list like this (only more accurate). Wonder if that'll ever happen. I suspect security will remain a privilege of the technical elite or those that can pay the technical elite. I guess maybe that's OK, but a bit concerning at a consumer level where it could be another factor increasing the class gap.

This press release is about security being increased in a product that has massive reach amongst those who are not the technical elite. There doesn't appear to be any extra fee for it as well.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#222
Does this mean I'll need to give Skype a verified phone number and some version of all my contacts for … reasons. Reasons that are, trust us, so important that we can't let you opt out of them, but that have nothing to do with us keeping your phone number.

I like everything else about Signal, but won't use it as long as they mandate that you tie your account to a verified, non-throwaway phone number. That's asking for more trust than I'm willing to give.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#223

The thing is. How will Microsoft and Skype handle backdoors now. As far as I understood the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. Not always the good countries. But this. This baffles me. Deeply.

>the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. That seems like pretty unreasonable tinfoil. There is no reason for Microsoft to want to give information to governments. I assume they don't pay, and the cost is consumer trust. Makes a lot of sense to rearchitect such that you can't give in to government demands.

This is a legitimate argument in 2018? You're not spied on because... tinfoil?

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#224

Earlier quoted context omitted.

I think it was a patent issue. No one is allowed to use p2p for chat.

It does look like IBM does own a p2p instant messaging patent[1]. So I think this checks out. - https://www.google.ms/patents/US7675874

There was just a comment thread (on the slack outage article) recently discussing why there are no good p2p chat programs.

This might be one reason why. Fuck software patents.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#225

Earlier quoted context omitted.

Microsoft used centralised servers because the Skype prior to that was a curse to mobile devices running on battery power. Particularly cellphones. Skype worked as a p2p network, where some peers where marked as super peers and would help with peers behind firewalls (UDP-holepunching), and routing through the super peer. If your phone became a super peer, you could expect to essentially work like a server, with the "…

This doesn't explain why after the change Skype started routing calls between machines on the same LAN through Microsoft servers.

They made a decision to ditch P2P and route all calls through their servers. Local calls would fall into the "P2P" umbrella.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#226

Earlier quoted context omitted.

Microsoft used centralised servers because the Skype prior to that was a curse to mobile devices running on battery power. Particularly cellphones. Skype worked as a p2p network, where some peers where marked as super peers and would help with peers behind firewalls (UDP-holepunching), and routing through the super peer. If your phone became a super peer, you could expect to essentially work like a server, with the "…

This doesn't explain why after the change Skype started routing calls between machines on the same LAN through Microsoft servers.

It is difficult to make a p2p app on a mobile device work even between devices on the same LAN.

A simplified explanation: Mobile devices will often ignore almost all incoming network traffic to reduce battery usage. The only way to reliably communicate with the device is through a centralized push notification service (e.g. APN and GCM).

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#227
post #206

Earlier quoted context omitted.

Operators have no interest in being reduced to "dumb pipes" (as the industry calls it). So OP is correct, P2P overlay routing has traditionally caused headaches for network operators traffic shaping. Any P2P tech that reaches this kind of scale would run into serious scalability challenges due to operator throtteling. - http://ieeexplore.ieee.org/document/6488287/ - https://www.computer.org/csdl/proceedings/p2p/2008/…

If all the mobile traffic is being routed through a single Microsoft-controlled "super-duper peer", then there is no P2P traffic. Or to put it another way: If I accept the choice is between routing mobile traffic to Microsoft, or no mobile-Skype support, I don't understand how it follows that all traffic needs to move through Microsoft, or no mobile-Skype support.

Because centralized and P2P architecturally are different beasts altogether. It'd be very hard to make a protocol that essentially did both, and centralization covers all use cases, so, as a company, it makes most sense to go with that.

I'm sure there were other reasons involved in the decision, I don't pretend to know them, but from a business perspective alone, you choose one connection methodology and you stick with it. Anything more is wasteful of resources.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#228

Does this mean I'll need to give Skype a verified phone number and some version of all my contacts for … reasons. Reasons that are, trust us, so important that we can't let you opt out of them, but that have nothing to do with us keeping your phone number. I like everything else about Signal, but won't use it as long as they mandate that you tie your account to a verified, non-throwaway phone number. That's asking fo…

I would presume that, whatever they say, the real reason for that is account deduplication.

To block spammers in a social network, you either need messages to be expensive to send (ala the old e-stamps concept) or you need 1. identities to be expensive to acquire, plus 2. the ability to ban identities. The simplest way to make identities expensive is to require that each account be tied to some sort of real-world scarce token that you can prove possession of, like a phone number.

If, when you ban a user, you also ban their token from being used to create new accounts, most casual users are stymied from "re-making", and professional spammers have their potential volume (and therefore potential ROI) lowered by an order of magnitude because they need to pay for phone numbers (at e.g. $1 a pop on Twilio) to in order to register the spam-accounts, and each of those spam-accounts (and therefore phone numbers) will be banned quickly enough that they won't have made $1 back by the time it happens.

The fact that account-deduplicating like this helps them get more accurate active-subscriber statistics is a nice bonus.

What this probably isn't, is a KYC measure. They don't care who you are; they just care that—whoever you might be—you only have one active account. (If you can think of a better way to achieve that without asking for potentially-identifying information, I'm all ears! Something something proof-of-stake? Make registration require you to burn an hour/day/week mining a token?)

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#229

Does this mean I'll need to give Skype a verified phone number and some version of all my contacts for … reasons. Reasons that are, trust us, so important that we can't let you opt out of them, but that have nothing to do with us keeping your phone number. I like everything else about Signal, but won't use it as long as they mandate that you tie your account to a verified, non-throwaway phone number. That's asking fo…

This is Signal the E2E protocol (also used by WhatsApp, Facebook Messenger and Google Allo), not Signal the app. The number requirement is part of the app. I assume your identifier in Skype will be your Skype name/MS Account.

Re: Signal partners with Microsoft to bring end-to-end encryption to Skype

#230

The thing is. How will Microsoft and Skype handle backdoors now. As far as I understood the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. Not always the good countries. But this. This baffles me. Deeply.

>the reason Microsoft broke Skype so badly was because they used centralised servers with backdoors for countries who wanted them. That seems like pretty unreasonable tinfoil. There is no reason for Microsoft to want to give information to governments. I assume they don't pay, and the cost is consumer trust. Makes a lot of sense to rearchitect such that you can't give in to government demands.

>That seems like pretty unreasonable tinfoil

Doesn't seem so to me.

>I assume they don't pay

You're dead wrong, my friend. They do pay. A lot. Think of all those juicy government contracts.

Post reply on HN