Privacy group demands answers from Skype
How secure is secure?
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Lobby group Privacy International is demanding Skype improves its VoIP service to properly protect the privacy of its users.
PI said it had reviewed Skype's security and had specific concerns including the VoIP service's use of full names on the contact list, which makes it easy for people to impersonate others.
The lack of an HTTPS download service means that a third party could interfere with the initial installation of the Skype client by tricking people into installing their own Trojan-infected version of the software.
Privacy International is also worried about the codec Skype uses to compress audio calls. PI reckons the VBR compression codec allows between 50 and 90 per cent of phrases to be identified.
The lobby group notes that many Skype users live under repressive regimes where the security, or not, of their private conversations may have serious consequences.
Eric King, Privacy International's Human Rights and Technology Advisor, said: "Skype's misleading security assurances continue to expose users around the world to unnecessary and dangerous risk. It's time for Skype to own up to the reality of its security and to take a leadership position in global communications."
PI calls on Skype to act quickly to resolve these problems in order to protect its users.
Privacy International's blog on Skype security is here.
A spokesman for Skype said: "Privacy International has not been in touch with us so it will take us some time to read and digest the report before we are in a position to respond. We will look into the points they have raised and will reach out to them. Skype takes these issues seriously and aims to provide users with the best possible levels of privacy and security."®
COMMENTS
Interesting comment at the end...
"Privacy International has not been in touch with us..."
So Privacy International are getting all worked up about, and complaining to the media without even contacting Skype first???
Surely the first thing you would do is contact Skype, tell them your concerns and see what they say. For all we know, Skype could have turned around and gone "My god your right, we need to fix this!" or they cuold have turned around and gone "Get nicked! We dont care about privacy!" Depending on the answer you get there, maybe then go and talk to the media. But going to the media first, really stinks of attention-seeking media whoring to me!!!
China, dodgy internet cafes
HTTPS doesn't protect you from a compromised download repository. What it protects against is a man-in-the-middle attack. If you travel to China and want to download Skype while you're there, how do you know that www.skype.com in China isn't being secretly redirected to their own spyware-infected variant?
Think what happens when you try to connect to the internet in an airport or in Starbucks. You connect ok, no wifi password needed. Then you go to www.google.com and hey presto you're redirected to the hotspot payment page. Worse still, you might think you're connecting to the internet in Starbucks when in fact you're connecting to the wifi network provided by the C.I.A. van parked outside. Before you know it you've downloaded a bugged copy of Skype and your terrorism plans / freedom-fighting plans are ruined.
Looking at the URL doesn't protect you if you can't trust the network operator. The operator can serve up whatever they want, without telling you. Only HTTPS can protect against this kind of attack.
Re: why are they concerned
Skype is "used to connect you with family and loved ones across the world for free" in the same way that BitTorrent is used to distribute Linux ISOs, VCRs are used to record TV shows for later viewing and personal use only, and the road network is used by properly licensed drivers with tax-paid vehicles either below or at the speed limit.
The technology is separate from the use; Don't make the mistake of Big Media and confuse the two.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
