[deleted]
Open Letter to Skype from Internet Activists, Journalists and Academics
61–70 of 70 posts
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#62Earlier quoted context omitted.
So how do you protect against MITMs?
Basically the client connects to SIP server using ssl connection authenticated on both sides. When placing calls the clients A and B are negotiating SRTP session key using DH key exchange. It is done over SIP (and not over RTP channel as in ZRTP). Each client upon registration generates public/private key pair and submits a CSR to the registration service which signs it and stores the public key (which is later used…
Hmm, it sounds resistant to random MITM but the server can still listen in on the calls if it wants, by MITMing the clients itself...
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#63Has there been any confirmation of the very juicy rumor about Skype and the NSA? Brieftly it is this: The NSA put out a $1 billion RFP to crack the encryption of skype - their inability to listen in on this huge communication channel was really a bummer for the NSA. Microsoft says "Hmm" and buys Skype for $8 billion, re-engineers the archtecture of Skype so that it is centralized rather than P2P and easily decrypted…
Complete nonsense.
Skype's architecture is changing to match the changes in user base. As more and more tablets, phones, televisions and other devices which can't act as a supernode are added - and will be added in future - Skype needs to run more servers to pick up the slack. The notion that this is for eavesdropping purposes at the behest of the NSA is best left to the tinfoil hat brigade.
That said, you'd be ill advised to depend on Skype being more secure than a regular phone call. As a commercial service it is subject to all the kinds of pressures telco's face.
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#64Has there been any confirmation of the very juicy rumor about Skype and the NSA? Brieftly it is this: The NSA put out a $1 billion RFP to crack the encryption of skype - their inability to listen in on this huge communication channel was really a bummer for the NSA. Microsoft says "Hmm" and buys Skype for $8 billion, re-engineers the archtecture of Skype so that it is centralized rather than P2P and easily decrypted…
Complete nonsense. Skype's architecture is changing to match the changes in user base. As more and more tablets, phones, televisions and other devices which can't act as a supernode are added - and will be added in future - Skype needs to run more servers to pick up the slack. The notion that this is for eavesdropping purposes at the behest of the NSA is best left to the tinfoil hat brigade. That said, you'd be ill a…
Not quite - CALEA legally requires telcos to cooperate with law enforcement and implement infrastructure for wiretapping. As far as I'm aware, no such law applies to Microsoft as they aren't a carrier under said law.
So any eavesdropping Microsoft lets law enforcement do is voluntary, whereas telcos have a legal requirement in this regards.
Metadata (call logs and such) is another story and are equally unprotected in practice.
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#65Earlier quoted context omitted.
Basically the client connects to SIP server using ssl connection authenticated on both sides. When placing calls the clients A and B are negotiating SRTP session key using DH key exchange. It is done over SIP (and not over RTP channel as in ZRTP). Each client upon registration generates public/private key pair and submits a CSR to the registration service which signs it and stores the public key (which is later used…
Hmm, it sounds resistant to random MITM but the server can still listen in on the calls if it wants, by MITMing the clients itself...
Yes, with the cooperation from CA the MITM is still possible. We however will provide server code to especially paranoid clients so they can build and run the software on their own machines... This way they can have garanties against certificate tampering.
And we're working on an alternative solution when even cooperating CA will not allow MITM...
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#66Earlier quoted context omitted.
Hmm, it sounds resistant to random MITM but the server can still listen in on the calls if it wants, by MITMing the clients itself...
Yes, with the cooperation from CA the MITM is still possible. We however will provide server code to especially paranoid clients so they can build and run the software on their own machines... This way they can have garanties against certificate tampering. And we're working on an alternative solution when even cooperating CA will not allow MITM...
That sounds very good, good luck! Why not use ZRTP, though?
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#67Earlier quoted context omitted.
Yes, with the cooperation from CA the MITM is still possible. We however will provide server code to especially paranoid clients so they can build and run the software on their own machines... This way they can have garanties against certificate tampering. And we're working on an alternative solution when even cooperating CA will not allow MITM...
That sounds very good, good luck! Why not use ZRTP, though?
Well, this tech is derived from the project which was designed to meet specs of one of our clients.
We did propose ZRTP during design phase, to the client but they security analysts decided against it. They affirm that given the state the current state of art in speech recognition and synthesis ZRTP can be vulnerable on impersonation during short code validation phase for the attacker with sufficient resources.
I'm personally doubtful, but one thing i'm sure about, is that this client security experts have access to info and resources which are not available to me.
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#68Earlier quoted context omitted.
That sounds very good, good luck! Why not use ZRTP, though?
Well, this tech is derived from the project which was designed to meet specs of one of our clients. We did propose ZRTP during design phase, to the client but they security analysts decided against it. They affirm that given the state the current state of art in speech recognition and synthesis ZRTP can be vulnerable on impersonation during short code validation phase for the attacker with sufficient resources. I'm p…
That sounds reasonable, thanks for the explanation.
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#69Would love to see something similar as what google does for transparency. Even better an common standard for transparency
Pretty sure Google will remain the oddball in the bunch. Nobody wants to reveal all that.
Re: Open Letter to Skype from Internet Activists, Journalists and Academics
#70there alternatives to skype that are open sourced and you can look up what security features they got. http://en.wikipedia.org/wiki/Comparison_of_VoIP_software
Skype is popular because it just worked, even through funky firewalls. The replacement would need to be better than Skype to gain traction with non-technical users.
How did the internet get so dumbed down? Cloud this and web app that and now nobody knows how to research or install any normal software. Or do anything that isn't shiny packaged at $10+ a month?