Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Skype from Internet Activists, Journalists and Academics

skypeopenletter.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#51

Post by vadiml »

StavrosK wrote: post #35
vadiml wrote: post #8

Folks please try Discretio for Android ( https://play.google.com/store/apps/details?id=com.discretio.... ) Open source (GPLv3) secure VOIP solution. For the moment only Android version is available but iOS and desktop vresions are in the queue...

That doesn't sound very convincing. You can't just have some icons tell you that you're secure, how do they know if someone's MITMing you? You can use the already-available ZRTP, that requires each user to speak a phrase to the other, so you can verify by hearing the other person's voice. Discretio doesn't do any of that, so how does it know you're not talking to some random attacker?

The client side source code is available: https://bitbucket.org/repo/all?name=discretio

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#52

Post by StavrosK »

vadiml wrote: post #51
StavrosK wrote: post #35

Earlier quoted context omitted.

That doesn't sound very convincing. You can't just have some icons tell you that you're secure, how do they know if someone's MITMing you? You can use the already-available ZRTP, that requires each user to speak a phrase to the other, so you can verify by hearing the other person's voice. Discretio doesn't do any of that, so how does it know you're not talking to some random attacker?

The client side source code is available: https://bitbucket.org/repo/all?name=discretio

I saw that, but I didn't see any explanation on how it works, and I'm pretty sure it's impossible to have security without verification. I can't read the code to verify that, sadly.

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#53

Post by Karunamon »

jjoergensen wrote: post #26

The governments in many countries are monitoring everything that you are doing. It is no longer a fictitious idea about what could be done. They collect and correlate sets of data and they use it for monitoring for abnormal behaviour and find potential threats. There is nothing that you can do about it. Your only safety is that you are completely irrelevant for them and they keep their mouth shut unless they have a v…

>There is nothing that you can do about it.

Such irrational defeatism.

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#54

Post by Discretio »

StavrosK wrote: post #52
vadiml wrote: post #51

Earlier quoted context omitted.

The client side source code is available: https://bitbucket.org/repo/all?name=discretio

I saw that, but I didn't see any explanation on how it works, and I'm pretty sure it's impossible to have security without verification. I can't read the code to verify that, sadly.

Curious to hear from someone working in a company who says things but not show it's true. In fact, if i say i am rich, tall, blond with a famous sense of humour, you are ready to believe me, but if i don't say anything but i prove it, you refuse to believe me... strange. Discretio doesn't say anything of this kind but show the entire client software source code. Do the same please.

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#55

Post by StavrosK »

Discretio wrote: post #54
StavrosK wrote: post #52

Earlier quoted context omitted.

I saw that, but I didn't see any explanation on how it works, and I'm pretty sure it's impossible to have security without verification. I can't read the code to verify that, sadly.

Curious to hear from someone working in a company who says things but not show it's true. In fact, if i say i am rich, tall, blond with a famous sense of humour, you are ready to believe me, but if i don't say anything but i prove it, you refuse to believe me... strange. Discretio doesn't say anything of this kind but show the entire client software source code. Do the same please.

So how do you protect against MITMs?

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#56

Post by magikarp »

StavrosK wrote: post #47
magikarp wrote: post #46

Earlier quoted context omitted.

I would appreciate it if Silent Circle did not repeatedly claim to the media that the code has already been openly released and reviewed when it hasn't been.

I'm not aware of that. The Silent Text repo is here: https://github.com/SilentCircle/silent-text Do you have any references of anyone saying the code of the other clients has been released? I'm curious.

Silent Text is only one (and the smallest) component of the Silent Circle suite; this source code release is an incomplete excuse.

Here's one article out of many where Silent Circle makes claims of complete open source. http://www.lemonde.fr/sciences/article/2012/12/13/le-cryptag...

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#57

Post by arindone »

Recurring transparency report? Have you ever asked Google for such things when it reads your emails to sell you ads? Have you ever asked Target or Walmart for this when they track your credit card purchases and sell the ACTUAL data to other parties?

Stories like this are driven mostly by unverified rumors and sensationalist journalism that is JUST as rampant in the tech industry as it is in politics, economics, or any other topic covered in mass media today.

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#58

Post by Discretio »

StavrosK wrote: post #55
Discretio wrote: post #54

Earlier quoted context omitted.

Curious to hear from someone working in a company who says things but not show it's true. In fact, if i say i am rich, tall, blond with a famous sense of humour, you are ready to believe me, but if i don't say anything but i prove it, you refuse to believe me... strange. Discretio doesn't say anything of this kind but show the entire client software source code. Do the same please.

So how do you protect against MITMs?

You still ask for words, i still ask for your source code...

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#59

Post by StavrosK »

Discretio wrote: post #58
StavrosK wrote: post #55

Earlier quoted context omitted.

So how do you protect against MITMs?

You still ask for words, i still ask for your source code...

I don't own the company, thus I can't give you the code. You can give me an explanation, but won't. Why?

Re: Open Letter to Skype from Internet Activists, Journalists and Academics

#60

Post by vadiml »

StavrosK wrote: post #55
Discretio wrote: post #54

Earlier quoted context omitted.

Curious to hear from someone working in a company who says things but not show it's true. In fact, if i say i am rich, tall, blond with a famous sense of humour, you are ready to believe me, but if i don't say anything but i prove it, you refuse to believe me... strange. Discretio doesn't say anything of this kind but show the entire client software source code. Do the same please.

So how do you protect against MITMs?

Basically the client connects to SIP server using ssl connection authenticated on both sides. When placing calls the clients A and B are negotiating SRTP session key using DH key exchange. It is done over SIP (and not over RTP channel as in ZRTP). Each client upon registration generates public/private key pair and submits a CSR to the registration service which signs it and stores the public key (which is later used to authenticate the above mentionned ssl connections) in the SIP server's DB... The server has no access to the client's private key nor to the SRTP session key
Post reply on HN