News for hackers. Stuff that matters.
Re:Skype backdoor confirmation by austengary on Saturday May 18, 2013 @05:58AM (#5728400)
A backdoor in their encryption protocol. They claim it is secure.

"The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]"

[1]: http://download.skype.com/share/security/2005-031%20security...

Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption

Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.

Re:Skype backdoor confirmation by downandout on Saturday May 18, 2013 @12:04PM (#5729345)
The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy.

http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa...

(this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).

Re:Skype backdoor confirmation by lucb1e on Saturday May 18, 2013 @06:56AM (#5728499)
Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...
Re:Skype backdoor confirmation by drivebyacct2 on Saturday May 18, 2013 @08:30AM (#5728677)
No. No. No, no, no, no. These are two different things.

One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works.

Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud.

At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers.

So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?

Re:Skype backdoor confirmation by spellboots on Saturday May 18, 2013 @09:54AM (#5728910)
I think you are missing the point - the article proves (unless the author is flat out lying) that text chat through skype, which is claimed to be end-to-end encrypted, is not, as requests are being made to the URL.

It may currently be for innocent purposes (check URLs, thumbnails etc as you said). However the fact is that they can make these requests at all show that the encryption is not end-to-end, otherwise they wouldn't know the URL to make a request to at all! The request isn't being made from the client, the IP shows it comes from Microsoft's servers.

So, you're talking about voice, but this is proof that the textual chat connection that should be secure end-to-end is decrypted and routed through Microsoft's servers.

Re:Skype backdoor confirmation by kvb on Saturday May 18, 2013 @10:32AM (#5729019)
Or maybe the client forwards the URL to a Microsoft service which accesses it.
Re:Skype backdoor confirmation by notdang on Saturday May 18, 2013 @11:57AM (#5729313)
If it did this, then it can forward the chat conversation as well
Re:Skype backdoor confirmation by MrBra on Sunday May 19, 2013 @10:15AM (#5732888)
Exactly... ..for those who didn't get it yet, that's the main point in all this worrying about the presence of a backdoor in Skype.
Re:Skype backdoor confirmation by BadCRC on Saturday May 18, 2013 @02:26PM (#5729820)
but the linked page doesn't prove that it is.
Re:Skype backdoor confirmation by MrBra on Sunday May 19, 2013 @10:17AM (#5732896)
You would only get a real proof if it was open source.