Clearing The Air On Skype: Most Of What You Read Was Not Accurate, But There Are Still Reasons To Worry

from the let's-dig-in dept

Over the last few days there's been something of a firestorm of people claiming that Skype was letting police listen in on your calls. We had been among those who noted that Skype was, at the very least, no longer willing to make clear statements about whether the service was able to be wire-tapped. Skype to Skype calls are a direct person-to-person connection (rather than through a central server), so most people thought that they were not particularly tappable. That's not quite true. And, of course, if you use Skype as part of a phone call to or from a regular phone line, those calls would be tappable via traditional phone wiretaps.

The "Skype may be letting law enforcement listen in on your calls" furor took off in the following few days. The Washington Post reported that Skype was making it easier for law enforcement to get text chat and user data. It's not actually clear that this is true either (but more on that later). It then kicked into high gear, when Eric Jackson at Forbes (whom we've written about before for his bizarrely uninformed take on the Yahoo/Facebook patent fight and those who reported on it) wrote a ridiculously ignorant post claiming that Microsoft can listen in on all his Skype calls, based off an incredible misreading of the original post about Skype's refusal to comment directly on the wiretapping abilities.

Jackson's more level-headed colleague, Kash Hill, pushed back on Jackson's claims, but also noted that the law (in the US) is pretty clear that there is no legal requirement for Microsoft to make Skype tappable... but there have been regular efforts made to change that. Hill spoke to legal expert Jennifer Granick who pointed out that just the uncertainty and threat that such legislation might come down the road at some point seemed to be leading companies to make development decisions that left open the possibility of surveillance:
The mere threat of regulation is driving innovation in the direction of backdoors and surveillance compliance. And US law doesn’t require that, yet.
But what's actually happening, since so much of this seems to be conjecture and speculation? Well, as the attention and questions grew, Skype itself weighed in to "clarify." It noted that it has been installing more in-house "supernodes" (in the more distant past, various Skype users would act as supernodes) to improve quality for the directory -- but that Skype to Skype calls (again, not calls that touch the public telephone network) were still encrypted person-to-person calls:
The move to in-house hosting of "supernodes" does not provide for monitoring or recording of calls. "Supernodes" help Skype clients to locate each other so that Skype calls can be made. Simply put, supernodes act as a distributed directory of Skype users. Skype to Skype calls do not flow through our data centres and the "supernodes" are not involved in passing media (audio or video) between Skype clients.

These calls continue to be established directly between participating Skype nodes (clients). In some cases, Skype has added servers to assist in the establishment, management or maintenance of calls; for example, a server is used to notify a client that a new call is being initiated to it and where the full Skype application is not running (e.g. the device is suspended, sleeping or requires notification of the incoming call), or in a group video call, where a server aggregates the media streams (video) from multiple clients and routes this to clients that might not otherwise have enough bandwidth to establish connections to all of the participants.

[....] Skype software autonomously applies encryption to Skype to Skype calls between computers, smartphones and other mobile devices with the capacity to carry a full version of Skype software as it always has done. This has not changed.
But... is there still reason to be somewhat (though not hysterically) concerned? Perhaps. Chris Soghoian has the best post by far on what's known and what's unknown, which explains how Skype's person-to-person encryption may not be as totally untappable as some people assume. He notes that while the Skype to Skype calls are encrypted, Skype has access to the encryption key (he has a full explanation for how/why this is) and then explains what this likely means:
Ok, so Skype has access to users' communications encryption keys (or can enable others to impersonate as Skype users). What does this mean for the confidentiality of Skype calls? Skype may in fact be telling the truth when it tells journalists that it does not provide CALEA-style wiretap capabilities to governments. It may not need to. If governments can intercept and record the encrypted communications of users (via assistance provided by Internet Service Providers), and have the encryption keys used by both ends of the conversation -- or can impersonate Skype users and perform man in the middle attacks on their conversations, then they can decrypt the voice communications without any further assistance from Skype.
So there's a risk there, and Soghoian notes that Skype's reticence to set the record straight on exactly how it handles encryption leaves open this possibility. That is it's entirely possible that there are ways that law enforcement can intercept Skype calls, while Skype can still talk about its encryption, leaving the false impression that the calls are immune from interception. Soghoian also notes that the talk about Skype handing over info (not call access) to law enforcement is not new and has been known for quite some time (and, honestly, doesn't appear all that different from lots of other similar setups).

So, to summarize:
  • Skype did make some infrastructure changes recently, which did increase the number of self-hosted supernodes, but those changes likely were to increase the quality of the product, and had little to do with law enforcement/surveillance.
  • Skype has always had a program to provide available information to law enforcement if legally required to do so, but appears not to have made any major change to that program in quite some time. That program does not appear to include the ability to listen to calls.
  • Skype to phone (or phone to Skype) calls have always been tappable, because they touch the public telephone network, where they can be intercepted.
  • Skype to Skype calls remain encrypted, making it more difficult to "tap" them. However, because of the way Skype likely handles encryption keys, this does not mean that governments can't intercept the calls (or impersonate certain parties via Skype).
  • In the end, then, it appears that much of this discussion is a whole lot of fuss about nothing particularly new -- but it is worth noting that your Skype calls probably were never quite as secure as you thought they were, even if they're somewhat more secure than some other offerings with little or no encryption and a central server. But if you're looking for 100% secure communications, Skype isn't it -- but that's not because of any change. It's likely always been that way.


Reader Comments (rss)

(Flattened / Threaded)

  •  
    icon
    Ninja (profile), Jul 27th, 2012 @ 12:17pm

    Nicely written. I'm ok with Skype for now. But if you want better alternatives search for VoIP on Wikipedia. Plenty of open source alternatives encryption enabled.

    I hope the US won't make backdoors mandatory by law. Although, looking at how things are getting ugly quickly there, I won't be surprised if they do it.

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Jul 27th, 2012 @ 12:31pm

      Re:

      They just need the FBI to cook up another one of those home grown 'terrorist' plots and make sure it involves correspondence over skype. Maybe have one agent tell the sap that the government can't track skype and then have him set up a meeting with another agent and have that agent ask 'why skype' so the sap can parrot back their own reasoning and then use that soundbite to push the necessity of adding a legal requirement for backdoors.

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    John Doe, Jul 27th, 2012 @ 12:31pm

    The positive side of this negativity

    On the positive side of all of this negative press is that more and more people are being made aware of how much government monitoring is going on. Even more positive is people are learning there are ways like encryption to help prevent the eavesdropping. Soon enough, someone will create a true end to end encrypted Skype like service that does not have the encryption keys stored by a central party.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Jul 27th, 2012 @ 12:33pm

    "In the end, then, it appears that much of this discussion is a whole lot of fuss about nothing particularly new"

    This is probably the wrong conclusion to draw here. What Skype has done by upping the amount of in house supernodes is to make it so that Skype to Skype calls are more likely to interact with an in house node. With enough supernodes in house, they could all but remove supernodes from outside of their own control over time.

    This sort of shift would mean that Skype would be able to track all of your calls. No, they cannot tap them, but they could certainly provide law enforcement with a list of known associates, people you speak to frequently, etc. By removing the distributed nature of Skype and centralizing it, they get all of that benefit.

    As a side note, all of this makes it easier to deny someone network access (because there would be no way to call through if they are blocked), and also might allow Skype to insert pre-roll ads on connections and such.

    There are plenty of possibilities here, few of them are good.

     

    reply to this | link to this | view in chronology ]

  •  
    icon
    blaktron (profile), Jul 27th, 2012 @ 12:51pm

    Encryption keys

    Their mechanism of encryption likely corresponds to a self-signed certificate, which when coupled with the (assumed) skype-software enabled signing mechanism, would enable them (with some account information of yours) be able to impersonate you in a conversation, but its unlikely that they would be able to use that information to decrypt previously recorded conversations.

    However, if skype is smart, they would include your password (or hash of) in their signing procedure, and that would make it VERY difficult for anyone to decrypt your communications without first having your password (which Skype would not turn over).

    It would be nice of them to describe in public EXACTLY how their encryption is handled, but unless Skype is using only accessible attributes to sign your communications, we have nothing to worry about when it comes to decrypting communications.

    Mike - Do you have anyone on staff that you run these kind of questions by, like someone involved in PKI rollouts or the actual creation of certificate based encryption schemes? For someone who isn't deeply involved in computer security, you know quite a bit, but there are a few gaps that are only apparent to true experts in the field. Such as knowing that yes, Skype would have the master signing keys to their encryption, but it really depends on information they run through the algorithm that determines the level of security.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      Josh in CharlotteNC (profile), Jul 27th, 2012 @ 1:31pm

      Re: Encryption keys

      However, if skype is smart, they would include your password (or hash of) in their signing procedure, and that would make it VERY difficult for anyone to decrypt your communications without first having your password (which Skype would not turn over).

      I don't see how that would change anything. Skype already has the encryption key. Adding a password into the mix that Skype still controls does not change the level of security. If law enforcement can demand the keys, Skype still has to turn them over.

      Basically, we're talking key escrow here. There's a reason that went nowhere in the 90s among security professionals and crypto geeks. If you don't have control of your own key, you must trust the security of whoever is holding that key.

       

      reply to this | link to this | view in chronology ]

      •  
        icon
        blaktron (profile), Jul 27th, 2012 @ 2:00pm

        Re: Re: Encryption keys

        OK, and thats true if they use a standard, one time key to encrypt communications, but im sure they dont. I'm sure they self-sign a certificate using a master key + information directly contained in your account. That could be all 'public' info, like account name, email address, account number etc. It could also include 'private' information like password, which would make it MUCH harder to break, even with master keys.

         

        reply to this | link to this | view in chronology ]

        •  
          identicon
          Anonymous Coward, Jul 27th, 2012 @ 2:27pm

          Re: Re: Re: Encryption keys

          Uhm all that's needed is for everyone to have their own 'certificate' (self-signed or not) then get those certs distributed securely to your friends (by some undisclosed means).

          Now use the certs to authenticate whom you're talking to. Generate keys a new set of keys for the actual encryption (using public key cryptography) and communicate.

          Basically what skype is lacking are user specific certificates which means you can never be sure that you're not intercepted. Remember, encryption without authenticy is useless.

           

          reply to this | link to this | view in chronology ]

    •  
      icon
      John Fenderson (profile), Jul 27th, 2012 @ 3:10pm

      Re: Encryption keys

      (which Skype would not turn over)


      That conditional is what makes the inclusion of the password pointless.

       

      reply to this | link to this | view in chronology ]

    •  
      identicon
      Bill Stewart, Jul 27th, 2012 @ 8:33pm

      Re: Skype Encryption

      With closed source and a closed protocol, there never was a good reason to trust Skype. Back when they were based outside the US, there was a certain level of expectation that they hadn't been totally bullied into providing friendly convenient US/UK government wiretap access yet (or friendly Mafia access), but we still couldn't trust their security or even evaluate how much of it we needed to trust.

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Jul 27th, 2012 @ 1:31pm

    So what's a secure alternative to Skype?

    Something easy to set up - I gave Jitsi a shot recently, but I was left with the option to set up my own SIP server (impossible for me to do, and even harder for most of my parents, friends, etc) or the option to use MSN/Yahoo/Google and other insecure stuff.

    I would need a tool that makes my calls go directly from my computer to my contact's computer (no third-party serve in-between), which encrypts the data transferred, and which let's me have an always up-to-date list of contacts to easily call people (basically, I can't have a tool that won't work if my contact changes IP address overnight and hasn't told me the new address yet).

    Is there such a thing out there or is this still science fiction? I hear a lot of criticism of Skype, but realistic and decent alternatives are rarely offered.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      Josh in CharlotteNC (profile), Jul 27th, 2012 @ 1:58pm

      Re:

      I would need a tool that makes my calls go directly from my computer to my contact's computer (no third-party serve in-between), which encrypts the data transferred,

      Easy.

      and which let's me have an always up-to-date list of contacts to easily call people (basically, I can't have a tool that won't work if my contact changes IP address overnight and hasn't told me the new address yet).

      Harder.

      Either there's a central (or distributed) point to go to to locate a person on the network, or locations must be updated to everyone in the network when they change.

      There's going to be a trade-off between security and convenience in any communication system. How much convenience are you willing to give up for paranoia?

      Let's assume we have a Skype-like system. There's a central database of IP addresses to contacts. Clients update their address whenever they are signed in (effectively constant). You can query this database and get the location of an individual anytime you need it. But you don't know who controls the database - which means someone else can see who you're querying for. There's also the added bit that whoever controls the database knows where everyone on the network is at all times.

      Ok, so we don't fully trust whoever controls the database. We decide instead to switch to another system that has similar features, but in this case, the database is not real time - clients only update it once every 24 hours. But we have the benefit that we can download the entire database and query it ourself, so that whoever controls the database doesn't know who we're actually contacting - but there's the downside that the data may be stale and thus our contact unreachable until the next update.

      Either you always know where your contacts are, or you need someone else to keep track of them. There are downsides both ways. Also, this is very elementary level paranoia musing - there's plenty of places to go for really epic level paranoia discussions about crypto.

       

      reply to this | link to this | view in chronology ]

      •  
        identicon
        Anonymous Coward, Jul 27th, 2012 @ 3:09pm

        Re: Re:

        First, thanks a lot for your response, I found it insightful.

        Personally I'd be fine with a third-party keeping track of my contacts, but that might be only me of course and I can't speak for anyone else.
        The invasion of privacy in this scenario seems low enough that I can tolerate it.

        What I'm concerned about is having my conversations potentially monitored, but this doesn't seem to be an issue with Skype.

         

        reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Jul 27th, 2012 @ 1:31pm

    Whatever the case, I don't trust it.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    New Mexico Mark, Jul 27th, 2012 @ 1:58pm

    Encryption

    IMO, any encrypted data where a third party holds escrow (back door) keys should be treated by end users as if it could become public information at any time.

    Yes, I realize it might keep Johnny scriptkiddie from eavesdropping, but the parties we should really care about can and (in most cases) will eventually use or abuse that power.

    Even when encryption is done "perfectly", there is always the risk of a better attack algorithm or encryption flaw emerging. Adding the "we'll keep a set of master keys in our pockets but we promise not to use them" approach makes that "security" almost laughable.

    I'm not saying that using escrow keys is always bad. For instance, no company wants to lose years of work on an encrypted drive because a user forgot their password or quit suddenly. Just don't be lulled into thinking it is "your" private data any more. If another key exists, it isn't.

    Does this mean we all don our tin foil hats and forgo using Skype? Of course not. Just treat it as a semi-private conversation and enjoy. But where real security is required, use a really secure method. And hope that it doesn't have any hidden flaws.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    G+P, Jul 27th, 2012 @ 2:01pm

    Sorry, you are missing a few points.

    Skype admits to now store 30 day chat history, even if you don't. That means, Skype has extended log files on you now. And the people you communicate with.

    What about call/voice history?
    They don't say.

    Running their own "super nodes" means switching from a distributed, peer-to-peer system to a centralized, server-based system. More log files.

    And what does "required by law" mean? Luxembourg law? US law? California law? The same law Obama uses to detain or kill people? Is a request from the NSA/FBI/CIA/.. with a gag order good enough for Skype to roll over?

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      John Fenderson (profile), Jul 27th, 2012 @ 3:15pm

      Re:

      Running their own "super nodes" means switching from a distributed, peer-to-peer system to a centralized, server-based system.


      Only for text chat and "envelope" information (who you're talking to, when, and where). Voice remains p2p.

      And what does "required by law" mean?


      It means the law in whatever countries the people using it are in. They've made the pretty clear.

       

      reply to this | link to this | view in chronology ]

      •  
        identicon
        G+P, Jul 27th, 2012 @ 4:16pm

        Re: Re:

        That's a contradiction.

        In the US and a few other countries resident providers of telecommunication services are required to give direct, real-time, automatic, spying access to government agencies.

        (Sorry, I am not familiar with countries like Russia, Saudi Arabia, Syria, Korea, Ukraine, ...)

        If Skype follows the laws in all the countries, where it has users, they'd have had to hand over the encryption keys.

        Either way, they are lying.

         

        reply to this | link to this | view in chronology ]

  •  
    identicon
    Jim Bob, Jul 27th, 2012 @ 6:39pm

    Question.

    " That program does not appear to include the ability to listen to calls. "

    Please, explain to me how you would be able to tell.

    You looking at the source code or something?

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Travis Ehrenstrom, Aug 15th, 2012 @ 11:12am

    This is scary! I haven't been much of a skype user, but this is weird! I wonder how Skype feels about this? This type of PR could harm their business in an extreme way, but maybe it is a piece of the patriot act?

    Has anyone looked into the actual legislation that Skype has to adhere to?

    Thanks for letting us know!

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Oct 12th, 2012 @ 10:06am

    bad to have programs invade my contacts list without my wishes

     

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Follow Techdirt
A word from our sponsors...
Essential Reading
Techdirt Reading List
Techdirt Insider Chat
A word from our sponsors...
Recent Stories
A word from our sponsors...

Close

Email This