Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Communications IT

Skype Security and Privacy Concerns 128

Posted by Zonk from the conversations-can-hurt dept.
CDMA_Demo writes "Scott Granneman at Security Focus is discussing the security and privacy issues thanks to eBay's acquisition of Skype. Says the help section on Skypke's website: 'Skype uses AES (Advanced Encryption Standard), also known as Rijndael, which is used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates.' Scott Granneman debates that since Skype is owned by eBay and is closed source, we have no way of verifying this claim. Further, from the article: 'At the CyberCrime 2003 conference, Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials: 'I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information.' This raises interesting questions about how Skype and eBay together will try to avert cyber criminals from using security flaws in either system to their advantage.'"
This discussion has been archived. No new comments can be posted.

Skype Security and Privacy Concerns More

Skype Security and Privacy Concerns

Comments Filter:

  • 1.1 x 1077 keys? (Score:5, Funny)

    by TrevorB ( 57780 ) on Thursday September 22, 2005 @06:12PM (#13625383) Homepage
    All that new CSS and no superscripts?
    • Not even so much as shift+6!

      ^_^

    • Re: 1.1 x 1077 keys? (Score:1, Informative)

      by Anonymous Coward
      Who uses 1024 bit RSA to secure 256 bit AES? You need about 3000 bit RSA keys for the same equivalent time to break 256 AES. 1024 bit RSA isn't even really considered "very secure" anymore, mostly "sorta secure, for the time being"

  • Isn't that the way ... (Score:5, Insightful)

    by gregduffy ( 766013 ) on Thursday September 22, 2005 @06:13PM (#13625392)

    [since it] is closed source, we have no way of verifying this claim

    isn't that the way with all closed source software?

    • Re:Isn't that the way ... (Score:5, Interesting)

      by DarkHelmet433 ( 467596 ) * on Thursday September 22, 2005 @06:42PM (#13625592)
      However, the real interesting thing is how does eBay, a US company, get around the US export restrictions? eg: it's been mentioned that 128 bit AES is the limit that you can get export approval for. Given skype's 256 bit AES, will eBay have to weaken it when they release it after the ownership transfer is complete?

      Or do they have wiggle room and claim that its produced offshore and therefore isn't exported from the US, even though its now owned by a US company? I doubt that will go down well with the powers-that-be, because (among other things) that will just encourage US companies to offshore all their products-with-crypto work to get around the regulations.
      • The keys are not held by the user: the keys are held by Skype, and are thus perfectly amenable to a Skype controlled man-in-the-middle monitoring. By opening their capabilities to monitoring by US law enforcement, and by getting US Department of Commerce approval for its use and export to non-restricted countries, I'm sure that the relevant federal agencies are falling over themselves to make Skype or another similarly tappable system the de facto standard.

        Remember, unless you're the only one who owns the k
        • Actually most of the keys are generated and held by the end-users (or sometimes supernodes, depending on the NAT situations), and Skype mainly holds authentication keys. That doesn't mean that there aren't major problems - you simply can't trust closed-source crypto not to leak information, typically by bad design of key-handling protocols, and it's tough enough to trust open source.
      • Personally I'd be happy with 128-bit AES, as it is still way more secure than protocols such as the one that MSN Messenger uses.

        I've personally been using SimpLite [secway.fr], a free tool that can seamlessly encrypt MSN messenger traffic (with versions for YIM, ICQ, and AIM) by acting as a local SOCKS proxy that understands the protocol. It uses 2048-bit RSA keys with AES 128-bit encryption.
      • The regulations on export of crypto [doc.gov] changed significantly in the last few years. There is now generally no problem exporting AES256 or even Blowfish448 from the US.

        There are also regulations about how much content is of US origin, if there is less than 10% the regulations can be relaxed. Off shoring doesn't help if the parent company is still a US entity.

        These days the bigger problem with stronger crypto like AES256 is import into some countries rather than export from the US.
      • It's unlikely that the US government can force them to do it, especially if Skype retains a non-US development presence (ideally a separate company that's owned by eBay rather than just a bunch of eBay employees in Europe.)

        The big problem with Skype's crypto, though, is that it's closed-source and hasn't been seriously evaluated by experts - protocol design and key handling are *difficult* to do well, and it's unlikely that 128-bit vs 256-bit AES would be the weak link. For instance, some of the reverse

      • Re:Isn't that the way ... (Score:3, Interesting)

        by m50d ( 797211 )
        Or do they have wiggle room and claim that its produced offshore and therefore isn't exported from the US, even though its now owned by a US company? I doubt that will go down well with the powers-that-be, because (among other things) that will just encourage US companies to offshore all their products-with-crypto work to get around the regulations.

        That's been happening already, lots of multinational companies do their crypto work in Europe and then send the finished product to the US division, because onc

    • Does anybody know of an effort of somebody to reverse engineer the proprietary protocol? After all, they managed to do this with Kazaa.
      Or is just about everybody happy with the it is (running under Linux, too) and the possibility to control it via the API?
      Just wanted to know.
      Cheers, Florian

  • 1.1 x 1077 possible keys (Score:3, Funny)

    by Anm ( 18575 ) on Thursday September 22, 2005 @06:17PM (#13625414)
    I think I can manage to brute force 1185 keys by hand, let alone with a computer. (Guess the <super> tag didn't copy into the text input very well.)

    Anm

  • OK, that's it (Score:5, Funny)

    by ObjetDart ( 700355 ) on Thursday September 22, 2005 @06:19PM (#13625433)
    I'm switching back to my regular phone.

    Oh, wait...

  • one word : audit (Score:3, Insightful)

    by alexandreracine ( 859693 ) <alexandreracine@gmail.com> on Thursday September 22, 2005 @06:19PM (#13625435) Homepage Journal
    They could make some code audit by independent security firms, but will they? (Yes, but only if they are very serius about security)

    • Re:one word : audit (Score:3, Insightful)

      by trime ( 733350 )

      That requires you to trust the independent security firm. Maybe you do, maybe not. Depends how thick the tinfoil is; if you have several layers then you're able to check open software for yourself. If you have just one layer then you might consider agreement among several other trusted individuals to be good enough. If you don't know what I'm talking about then probably you'd probably be happy to take ebay's word for it anyway, and it doesn't matter.

      The point is that a closed review by a closed company fo

    • I really don't understand Slashdotters' paranoia about Skype due to it being closed source. Why Skype particularly? Are you sure that Internet Explorer is not replicating all the traffic you do over https to Microsoft? Or how about Opera, they're closed source and up until now they were audacious enough to actually CHARGE MONEY for their software!?! How do you know all your internet banking is not accumulating in logs in some Opera server? Or whatever editor you use like EditPlus, why don't you suspect it's

  • Good encryption or not.. (Score:5, Informative)

    by lightyear4 ( 852813 ) on Thursday September 22, 2005 @06:19PM (#13625440)

    Good encryption or not, I'd be more worried about the recent moves of the FCC to allow law enforcement virtual wiretap access. Our freedoms have eroded enough as of late, and it is disconcerting to say the very least. Here is the relevant link from the article [fcc.gov] and from the eff [eff.org]
    • Good encryption or not, I'd be more worried about the recent moves of the FCC to allow law enforcement virtual wiretap access.

      The FCC considers skype an instant messanger service that happens to do voice. Hence, 911 and wiretapping laws do not apply.

      • This might not last for very long, as Skype's voice traffic increases. Can FCC re-qualify Skype?

        BTW, do you mean that law enforcement would not be able to wiretap text-based IMs should it need that? "Hey terrorists, just use icq / aim / skype IM to share plans, the authorities aren't going to look!" -- did anybody use this rhetoric yet?
    • Good encryption or not, I'd be more worried about the recent moves of the FCC to allow law enforcement virtual wiretap access.

      Encryption is exactly what we should worry about. As long as there is good end-to-end encryption, it doesn't matter how much the authorities want to listen in on your conversation. Wiretap access will do them no good, unless you have really powerful enemies and NSA knows things the public doesn't, in which case you're out of luck anyway.

  • Is there even a coherent thought here? (Score:5, Insightful)

    by Ingolfke ( 515826 ) on Thursday September 22, 2005 @06:21PM (#13625456) Journal
    This post has to be one of the dumbest I've ever read. Because Skype's protocol isn't public and e-Bay shares information (whatever the hell that means) there's supposed to be some specific concerns because the two are now joined? I can see either point standing on its own as a potentially interesting topic, but how does verifying whether or not a piece of software actually uses the encryption schemes it says it does and a corporate policy to share information (note that would be information that is not encrypted and intended to be shared) tie together?
    • No, there's really no link between the two. It's akin to saying Windows is owned by Microsoft, and Microsoft sells information to marketers, so anything you type is being tracked by advertisers.

      (Let's leave spyware out of my poor simple analogy)
    • If you'd read the article, you'd see that this 'summary' isn't a very good one.

    • Re:Is there even a coherent thought here? (Score:5, Insightful)

      by Anonymous Coward on Thursday September 22, 2005 @06:34PM (#13625543)
      Ok, well let me try to spell this out:

      Company A says they encrypt -- good for privacy. If anyone had data collected, it will be encrypted and thus a bit more meaningless. We cannot verify if Company A is telling the truth. Maybe there's encryption, maybe there's not. Not good for absolute privacy.

      Company B readily shares information with others. Not good for privacy at all.

      Company B purchases Company A -- so B, with its reputation to piss away your privacy now has a product that may or may not protect your privacy.

      With the way B has conducted business, it may be implied that A isn't trustworthy, regardless of wheter they do encryption or not...simply because at the hands of B, your data isn't sacred.

      Almost like a Microsoft buying Claria or something.
      • Can't we verify Skype's encryption by packet-sniffing a Skype text chat session, then trying to read the text of the chat? It should be obvious whether the chat packets are encrypted or not. Since Skype claims to use the same encryption for chat and voice, then assuming they don't turn it off separately for voice, then that could be a quick and dirty way of verifying their encryption.

    • Re:Is there even a coherent thought here? (Score:5, Interesting)

      by temojen ( 678985 ) on Thursday September 22, 2005 @06:39PM (#13625575) Journal
      There are dual-recipient encryption systems. Scype could be using one to store the session key so Law Enforcement (with or without a warrant) can decrypt intercepted communications. Or just encrypting the session keys twice.

      It seems to me what the world (or at least tinfoil hatters and others, like lawyers and accountants, who handle confidential information) needs now is either
      1. A serverless, point-to-point, TLS with client key authentication Capable VOIP protocol, with multiple implementations, some of which are open source, or
      2. IPSEC protected SIP or H.323

      • Re:Is there even a coherent thought here? (Score:2, Informative)

        by Anonymous Coward
        Like Phil Zimmerman's upcoming not yet released zFone [philzimmermann.com]?

      • Great, who cares? (Score:3, Insightful)

        by Sycraft-fu ( 314770 )
        How is it different than the PSTN? The FBI has the capability, essentially, to dial a phone number and listen in on it. They need a warrant of course, but they can easily tap phone lines.

        If you depend on a communications provider to keep you data secure, espically from law enforcement, you are pretty naive. If you need to keep people out, you need to set up your own end-to-end encryption. Only then can you be sure (or at least reasonably sure) that no one is listening in. You should assume that the phone co

        • How is it different than the PSTN? The FBI has the capability, essentially, to dial a phone number and listen in on it. They need a warrant of course, but they can easily tap phone lines.

          Not since the patriot act they haven't needed a warrant.
          • Please quote the relivant section of the Patriot act (in it's current, as passed form) along with the relivant title code info so peopel can look it up? I'm asking this in honesty, I neither believe you or disbelieve you on this, I simply want proof. I find that most people are like me and have a very poor idea what's actully covered under the Patriot act. This leads to a great deal of innacurate and sometimes outright false information about it.

            So please point me to the relivant section so I can have a loo
            • Very well... Here's one [techtarget.com]

              google is your friend [google.ca]
              • I want the language from the act itself. I don't want to hear what someone claims it says, I want to know what it actually says. Also, according to what you linked, they do need a warrant. The standard has been lowered from what it used to be, but a warrant is still required. I know where to find the bill, same place you find all that kind of stuff, The Library of Congress, specifically their Thomas server (thomas.loc.gov). The relivant link is http://thomas.loc.gov/cgi-bin/query/z?c107:H.R.31 6 2 [loc.gov]: which has
                • How about USC 18 2709 [cornell.edu]

                  Section 505 of the P.A.T.R.I.O.T. act makes modifications to this codified section of law which clearly allows the FBI to gather evidence on demand without a warrant.

                  • Yes, that's the kind of thing I was asking for. Links (or references) to relivant laws. So, from the look of it what they can get without a warrant is name, address, length of service, and usage records. Doesn't look like they can actually tap the line itself without a warrant. Or at least I can't see any reference to taps made in either the title code or the bill. From, the look of it the title code you linked to is already updated to match with the patroit act.

                    So to me it looks like the no-warrant portion
                    • The problem is that there is no transparency in the process: how do you know that the judge who authorizes these wiretaps is an actual judge? IIRC the judge in question simply rubber stamps each and every wiretap request that comes before him and has only been known to deny a single tap (which happened to be related to 9-11 IIRC).

                      To make matters worse, there are probably secret legislation, rules and regulations that are followed but are classified and no never revealed. The de facto law (administrative

        • you need to set up your own end-to-end encryption. Only then can you be sure (or at least reasonably sure) that no one is listening in.

          Well, what you can be reasonably sure about is that they aren't decrypting it. Listening to either endpoint with bugs or mics or whatnot still works. Remember, in this sort of situation, law enforcement is the attacker, and attackers can always try to go around the barriers you set up, rather than trying to go through them.
        • Whenever I access servers at work, I do it via SSH, or some other similar encrypted method. Why? Well it would be a problem if someone at the ISP got the root password, they could do a lot of damage and we might never even know. They shouldn't be monitoring me like that, but it is too important to trust them with, I take it in my own hands.

          If you don't trust your ISP to some degree, you're in trouble; it would be easy for them to conduct man-in-the-middle attacks on your ssh sessions unless you transport yo
      • PGPPhone had this high level of end-to-end security almost 20 years ago. It used on RSA, which still had a valid patent, but the PGP web of trust is pretty good and you can always generate your own new PGP keys and publish only the public part.

        A modest re-write to operate on TCP instead of modems should be quite straightforward.
        • I believe Phil Zimmermann is doing you one better. (He's the guy who did PGPhone, back in the day.) His zPhone [philzimmermann.com] project is an end to end encryption system for IP telephony, using the RTP or SIP protocols. According to the site, it will work in unencrypted mode with a regular device, and do transparent encryption with another zPhone-capable one.

          So if it actually materializes -- and I think it will, Zimmermann has pretty much always delivered the goods to the community in the past -- it'll be a whole lot bette
      • 2. IPSEC protected SIP or H.323

        How about IWQRTZ protected DEY or U.6298? Or if that doesn't work, you could always reverse the polarity in the dilithium crystals.
    • I can see either point standing on its own as a potentially interesting topic

      Don't suggest it! They'll dupe it twice!

      Actually, and in all seriousness, why do the editors post related stories together or not even split stories? Won't multiple articles give them more traffic?
    • Security is one of Skype's selling points. The fact that there is no way to verify it, no way to audit the code, no way to check for a back door means that you can't rely on Skype security: you just don't know. Given the background of the company and its founder, it also seems doubtful that a lot of security expertise went into the product.

      And the fact that eBay has been willing to work closely with law enforcement means that they may well put in back doors even if they aren't already there.

      Bottom line: i
      • I'm not necessarily saying you're wrong about Skype making security a selling point, but I do think that there's a difference between a company's advertising and marketing rhetoric, and what people actually use it for. I don't know anyone who actually uses Skype for "security." I'm sure there are some people out there, but I'm willing to bet it's pretty rare. And those people are dumb.

        Most people use Skype because it's a lot cheaper than the regular phone company, and doesn't require a monthly service fee l
        • The rest of the threads are mere ego centric fightings.

          The bottom line is, "It connects two computers or one computer and a phone [and hopefully a phone to phone in future, which is just SkypeIn+SkypeOut, and proabibly this is what interests eBay: getting face to face with the Telecoms] to chat with an excellent quality of sound for free or for very cheap rates".

  • there is a more interesting question (Score:4, Funny)

    by toby ( 759 ) * on Thursday September 22, 2005 @06:25PM (#13625485) Homepage Journal
    This raises interesting questions about how Skype and eBay together will try to avert cyber criminals from using security flaws in either system to their advantage.

    What about "how eBay will try to help over-enthusiastic law enforcement deprive users of privacy"?

    Nah. Could never happen in a "freedom" loving country!

  • Skype vs eBay (Score:5, Interesting)

    by lordsilence ( 682367 ) * on Thursday September 22, 2005 @06:27PM (#13625499) Homepage
    According to Zennström (co-founder of Kazaa and Skype) whose company skype recently got bought by eBay, Skype will still be run as a separate company by him as the head.

    So I kind of doubt he'll actively be doing stuff to endanger peoples privacy.
    It's worth mentioning that he left Kazaa BEFORE they became known as an adware-bloated software.
    • i According to Zennström (co-founder of Kazaa and Skype) whose company skype recently got bought by eBay, Skype will still be run as a separate company by him as the head.

      If Zennström no longer holds a controlling interest in Skype (if he ever did), he's not necessarily privy to information as to what will happen to Skype when the dust settles.
  • Well, here goes my karma, but I think that in light of what the article mentions Skype and employees are going to have argue this over the DCMA.

    We should all hope that Skype employees win the suit, because like it or not we're going to have to fess up when it comes time to reconsider the DCMA.

    It all boils down to privacy protection; the employees and RIAA/MPAA are likely going to have a time with each other here!

  • Rub those elbows (Score:5, Insightful)

    by MonGuSE ( 798397 ) on Thursday September 22, 2005 @06:31PM (#13625527)
    Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials: 'I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information.

    Another words we help you guys out in law enforcement alot when we shouldn't so please don't step in and bother us when you should. Its a win, win we can both screw the little people at the same time.

    • Re:Rub those elbows (Score:1, Informative)

      by Anonymous Coward
      Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials: 'I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information.'

      Bull-fucking-shit. The company I work for found a piece of stolen hardware ($20,000+) listed on Ebay that we IDed with a very, very high probability belonged to our company (we had photos, serial numbers, etc). The s
      • Simple. Just put in a huge bid in the last few minutes and win the auction. Then you pretty much have the guy's name and address. Most of these people think they are invincible because they are on the internet.
    • You mean someone actually investigates Ebay fraud cases? *HAH*. Only when the victim's name shows up in the paper or it's many hundreds of thousands of dollars, or the Ebay phishing spammers would have been out of business 2 years ago.

      Way too many people get ripped off via Ebay, especially via credit card fraud. The credit card companies often write it off as a loss and make it good for the legitimate customers ripped off, but it's still massive amounts of fraud, and they simply don't investigate modest the
  • Simple answer: don't use Skype if security is an issue. Plenty of other providers. Now that Ebay have got their hands on Skype, chances are it will be sent right downmarket anyway.
  • Seems to me that anytime something gets too popular or mainstream the Slashdot crowd starts to turn on it. Google. Skype.

    What's next? Microsoft?
    • Seems to me that anytime something gets too popular or mainstream the Slashdot crowd starts to turn on it. Google. Skype.

      What's next? Microsoft?

      Naah... What makes you think Microsoft would ever become popular or mainstream? ;-)

      /Spiff

  • I love Skypke. I wish everyone used Skypke.
  • Besides the security implementation... somehow a friend of mine was blocking someone from a company we were working for. This person created a conference and in the conference room appeared a message saying that for privacy settings of the user he would not be able to be added to participate. Besides of the should and shouldn't of his deeds, the skype way of privacy itself delated him and may have ended costing him his job (he was fired 1 month after the incident).
  • When eBay acquired PayPal, eBay executives worried about long-term legal questions surrounding Internet betting. Even though it represented nearly 8% of PayPal's revenue, they decided to no longer facilitate payments for online gambling sites.

    Will eBay fold under US government pressure to provide a backdoor for eavesdropping on Skype calls? Mark my words, unfortunately, "YES".

  • Verifying it (Score:3, Interesting)

    by SamMichaels ( 213605 ) on Thursday September 22, 2005 @07:36PM (#13625925)
    Scott Granneman debates that since Skype is owned by eBay and is closed source, we have no way of verifying this claim.

    With all the talented people out there, I'm sure SOMEONE (dvd jon?) could easily test out the encryption strength. I doubt anyone would even notice if you do it to your own account and your own friends on the other side of the call.

  • 1024 bit is inadequate (Score:5, Insightful)

    by cameldrv ( 53081 ) on Thursday September 22, 2005 @07:37PM (#13625935)
    If you're actually worried about the government listening in, 1024 bit RSA is inadequate. Adi Shamir published a paper describing a device that for $1.1 million could crack 1024 bit RSA. You can bet that the NSA has a better device than that.
    • I might be willing to concede that 1024 bit may be inadequate if you're a target of the NSA. If you're a run-of-the-mill criminal, though, I can't imagine that your local police department or even the FBI will have acccess to the hardware and knowledge to break the encryption.
      • I'm sure the NSA and the FBI cooperate in these sorts of cases. If the government is after you, and they have the capability to crack your crypto, they're going to do it. There have been numerous news stories about the FBI being able to crack various crypto. It never specifies the method, but I wouldn't be surprised if some of them were direct attacks on RSA. The machines are cheap enough that it is also possible that NSA built the FBI a machine to do the cracking. Certainly the FBI's budget is big eno
    • That's $1.1M per crack, not 1.1M per machine, and no, the NSA is unlikely to have a better machine than that, because the academic crypto world has pretty much lef them in the dust the last decade or so. If you've pissed off the Feds enough that they're willing to spend $1M to crack one of your phone calls, you've got much more serious problems. It's still a lot cheaper for them to black-bag your laptop and install a key-logger to steal your passwords and email your microphone's signals to kgbvax.

      But fr

      • What leads you to believe that academic cryptographers are ahead of NSA, in particular in the field of breaking relevant crypto with practical hardware?

  • eBay has pretty bad security actually (Score:4, Insightful)

    by saskboy ( 600063 ) on Thursday September 22, 2005 @07:42PM (#13625958) Homepage Journal
    In the 3 years I've been using eBay, I know of several security breaches, one of which allowed people to access an administration interface through the web, giving them access to personal information of nearly anyone using the eBay message boards [which shares login information with the main site].

    I'd trust eBay with security [and PayPal with fairness] about as far as I can throw it.
  • One awesome way to avert cyber criminals (as well as non cyber criminals?) from using ebay and skype is to talk constantly about how willing ebay and skype are to hand over anything and everything that law enforcement asks for. I'm not even a criminal and I don't want to use ebay and skype. The plan's working!
  • For those interested to know more about the security issues associated to VoIP, you may wish to read this article [itmanagersjournal.com]. I think [ccirrus.per.sg] it's a great article as it talked about the three important aspects of VoIP security: confidentiality, availability and integrity.

  • This raises interesting questions about how Skype and eBay together will try to avert cyber criminals from using security flaws in either system to their advantage.

    Look at what Yahoo! did to the alleged Chinese "spy"—work with the Chinese government to release information posted online via Yahoo! servers. Reporters without Borders was surprised how easy it was for Shih Dao (forgive my misspelling) to be caught, but it turns out that Yahoo! handed the Chinese government information on this repor

  • The whole article sounds like black PR to me ! GoogleTalk has NO encryption at all and is closed source too. Does that make it more private ? Everyday I see praises for Google and bad things about their compaetitors(e.g Yahoo, Skype).
  • Isn't Kopete [kde.org] adding skype protocol support? That would allow you to check it was encrypting properly.
  • Skype is going to have trouble competing with Google Talk. I used Google Talk to talk to my brother in China today, and used Skype a few minutes later to talk to him as well. The sound quality was significantly better using Google Talk. This dispute the fact that Skype has a huge head start. In general, Skype has been around for a while and their website is still amateurish and customer service non-existance. It is absolutely impossible to get a real human at Skype to send you an email.
  • The only way you can ever be really sure that a piece of security software really is secure, is to read the source code.

    Imagine some complete stranger comes up to you, and says he will deliver a secret message for you: if you dictate the message to him, he will write it down in a code so secret only he and his brother understand it, then send it to his brother, who will decode it and read it out to your correspondent.

    Skype might be secure; it might just as probably be horrendously insecure. Without an
  • As security experts, I would find fault with telling the world this much about any security system. The first error here is letting this much information out at all because it narrows down the possibilites. The fact that this can not be confirmed is irrelevant. Any security system should NOT be able to be confirmed by the public, including public source. Make it as hard to crack as possible and keep it as secret as possible. Asking for any security system to be confirmed or confirmable is not only ridi

Slashdot Top Deals

THEGODDESSOFTHENETHASTWISTINGFINGERSANDHERVOICEISLIKEAJAVELININTHENIGHTDUDE

Close