Skype backdoor confirmation

http://lists.randombit.net/pipermail/cryptography/2013-May/004224.html

by austengary • 13 years ago

345 115 13 years ago

lists.randombit.net

This is totally nit-picky, but strange use of the word "backdoor." When I read "backdoor" I was expecting to read about some malware-like functionality within the Skype client itself, but instead this is just telling us that Microsoft can read content after it is sent to them via the client and decrypted.

I would prefer Microsoft stopped scanning/reading my conversations, and I agree that what they're doing (e.g. accessing URLs) is a problem (and arguably illegal, given the recent case about someone accessing insecured AT&T URLs and going to jail).

Just think the original title could have been more clear.

oelmekki2• 13 years ago

Seconded. It's more a man in the middle to me. Still a problem, though.

austengary• 13 years ago

A backdoor in their encryption protocol. They claim it is secure.

"The Skype Security Policy is: ... 4. Messages transmitted through a Skype session are encrypted from Skype-end to Skype-end. No intermediary node, if any exist, has access to the meaning of these messages. [1]"

[1] http://download.skype.com/share/security/2005-031%20security...

Aforementioned referenced on + additonal security overview/facade: http://www.skype.com/en/security/#encryption

Their hybrid peer-to-peer/client–server implementation allows for eavesdropping. This is now confirmed to be in practice.

lucb1e• 13 years ago

Oh, that quote from the security policy finally explains why this is so big news. MSN still doesn't use SSL and that's not big news in anyway. But MSN never promised to use end-to-end encryption...

drivebyacct24• 13 years ago

No. No. No, no, no, no. These are two different things.

One is a feature designed to allow them to check URLs, fetch thumbnails, etc. The other is a very pivotal core decision in how Skype works.

Skype has always been primarily node-to-node. Doing p2p connections like that required signaling/directory services. In the past, users' computers were used for that functionality. After their purchase, Microsoft transitioned those signaling/directory services to the cloud.

At worst, this gives Microsoft the ability to see who is calling who, I'll grant that. Worst case scenario, you can't negotiate via STUN and UDP hole punching or UPnP port forwarding, then you will get stuck with TURN and that will route through Microsoft's servers.

So, unless someone has proof of a connection that should have established peer-to-peer and instead the call itself was routed through MS's servers TURN style.... then can we ALL please stop repeating this obnoxious rumor about MS eavesdropping on all Skype calls. Or worse yet tying it to some URL lookup service?

downandout2• 13 years ago

The document you are referring to is from 2005. It is no longer end-to-end encrypted. Microsoft not only can intercept your communications, but in fact stores them for 30-90 days per their publicly posted privacy policy.

http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa...

(this apparently does not apply to voice calls, but either does the complaint that they are picking up URLs and visiting them).

drivebyacct24• 13 years ago

Besides this hair-on-fire title and intro, this is pretty much just yet another rehashing that Skype visits URLs in chats?

(Honestly, if you'd just asked, I would have been assumed this would have been the case anyway)

mixedbit2• 13 years ago

You are aware that many popular services allow to share stuff privately using URL encoded credentials?

ThomPete• 13 years ago

Isn't it only a problem if they actually use it to identify you.

If they just use it the same way that google uses gmail I fail to see the problem.

np422• 13 years ago

If you provide means for private communication, it's not preferred that it's private - it's a requirement.

Gentlemen don't read each others mail.

tomjen3• 13 years ago

Your last statement is so painful, because reality is so far from what it should be.

mtgx4• 13 years ago

Considering there was an article just a few days ago in NYTimes [1] claiming that "Skype is so secure because of its decentralization" that law enforcement tries to pass laws against it, I'd say a lot of people aren't aware that Microsoft does have access to all the information at this point thanks to their "super-nodes", but even NYTimes writers aren't aware of it (or maybe it was just a cloaked advertorial for Skype).

I'll also continue to say how extremely disappointed I am that none of the major IM players (not Google, not Apple, not Microsoft, not Yahoo, not Facebook) wants to implement OTR encryption in their chat apps. Google even removed their fake "OTR" from the new Hangouts app, which I believe only hid your logs from yourself, not from Google themselves.

[1] http://www.nytimes.com/2013/05/17/business/concerns-arise-on...

Sami_Lehtinen• 13 years ago

There are also truly distributed solutions like Bitmessage. https://bitmessage.org/

film42• 13 years ago

But the whole purpose of the new handouts app is that all clients are syncd. That's kind of hard if 3rd party apps don't have the same ability. Then all you're left with is useless encrypted messages.

err_badprocrast• 13 years ago

I believe the differentiation is that Skype routes calls p2p by default, so wiretapping them is hard. It may be possible for Skype to record calls, but only when it's routed through Supernodes - a mode usually reserved for when firewalls prevent a p2p connection.

Call metadata like to/from, time, and call length are stored - as is all text.

glurgh2• 13 years ago

I don't think it's nitpicky at all - it would be different if Skype, Microsoft or anyone else had actually made a promise that messages that pass through their service are unreadable to them.

While it's technically possible it's not the norm and it's hard to come up with examples of services that actually do make this promise - tarsnap is one that comes to mind.

rbanffy4• 13 years ago

Readable is one thing. Read and used is a completely different thing.

zerr• 13 years ago

Yup, title needs to be changed. After reading it, I immediately closed Skype.

RandallBrown• 13 years ago

That article was nonsensical. English probably isn't their first language, but I have no idea what they're saying.

rdl• 13 years ago

Indeed, Adam Back's first language is C or Perl I think.

wfn• 13 years ago

The slang is very common in crypto* newsgroups of these sorts, I didn't find anything unusual or un-parseable in the message.

vacri• 13 years ago

The best I ever saw was when I had a subtle weird issue with a windows graphics driver. The only place I could find on google that looked like it had the answer was a Filipino gamer board... but the only problem was that the thread was a mix of English, Tagalog, and l33tspeak. I could tell that the answer was probably there, but I couldn't interpret it...

Havoc• 13 years ago

Could someone help me understand why the password changed from "bar" to "yeahright"? Or is that just a mistake on the authors side?

claudius3• 13 years ago

He probably typed out the string in the paragraph and copy-pasted the logs, so likely it is just a mistake on the author’s side.

quackerhacker2• 13 years ago

Don't be surprised. While I can see 2 sides to this argument (it was discussed earlier here on HN, link below), we shouldn't be too surprised by what some companies do to "optimize," their products. Microsoft autocrawling http(s) links could be either for obtaining new bing search results (and it could make that result relative to your conversation), or it could be for security to screen links.

I don't know, but I agree that if you have a secret conversation, take steps like PGP to keep it secret. Big Brother is ALWAYS listening :: usually a good preventative security motivation ;)

https://news.ycombinator.com/item?id=5721006

oelmekki2• 13 years ago

I wouldn't be surprised it this was intended to help bing discover deep web. If it's the case, combine that with the ability on bing to do "ip:<ip>" searches, and you have a formidable tool for forensics.

quackerhacker2• 13 years ago

I agree with this. I know that when I've done webdev and when I check out a unique sandbox url (like jumbled letters with no backlinks) for a page I'll design, I use to see GoogleBot crawl that page eventually in the logs. (guess what browser I was using...Chrome)

cskau• 13 years ago

Chrome has all kinds of services like "resolve navigation error", "URL prediction" and "usage statistics". That Chrome sends your URLs out there on the Internet isn't exactly a secret. If it bothers you, you can disable some of the features under 'Privacy' on:

chrome://settings/

The difference here is that Chrome doesn't pretend to be a secure communication channel like Microsoft claims Skype is.

maaaats• 13 years ago

This is misleading, it's not a backdoor. At least not my definition of backdoor. Anyways, if you need secrecy, don't use a service like this.

I have read people speculating if it's for spam/malware protection. They screen the urls to see if it's a redirect to known malware.

burgreblast• 13 years ago

Agreed. This is one of those "improve the service things".

GOOG would do the same, but then sell ads against the data and everyone would say the ads are ok, because they're also operating a free, and very useful service.

buster5• 13 years ago

Very strange article. It only re-does what all other news sources already stated.. plus, i think that commonly a backdoor is understood as something in the software itself that let's someone get access from the outside, which doesn't appear to be the case.

Plus, to think that skype would be exempt from the governments claim to get access to all communications and messaging data is very simple-minded. The guy does realize that today governments can access all his mails, right? SSL/TLS or not.

claudius3• 13 years ago

I have reason to believe that the government cannot access all my mails. But if it could, I’d be even happier, as it would either prove a fault in GPG (unlikely) or a working quantum computer implementing e.g. Shor’s algorithm. And who wouldn’t want to hear of the latter?

buster5• 13 years ago

I have reason to believe that you're wrong, because if you're under surveillance by the FBI or whatever, they will be able to read your mail. Unless you're the ultra-paranoid guy there are ways to get to your password physically :(

(so, since you're coming up with GPG which i obviously was not referring to i can also come up with some unlikely scenario, ok?)

ksk• 13 years ago

Have people checked if the client itself sends the URLs separately via some webservice (as opposed to MS being able to decrypt the IM) ?

sp332• 13 years ago

I have this question too. While still not good, this is the new best-case scenario.

nr0mx• 13 years ago

This is the company currently running ads positioning itself as a company that holds privacy dear.

"At Microsoft, we take our responsibilities for protecting your privacy very seriously. It’s a priority across all our businesses, and an area where we continue to work closely with others throughout academia, government and industry."

http://blogs.windows.com/ie/b/ie/archive/2013/04/22/consumer...

"Your Privacy is Our Priority" "The lines between public and private may never be perfect, but at Microsoft we are going to keep on trying, because your privacy is our priority." https://www.youtube.com/watch?v=bt51MWll1oY

mtgx4• 13 years ago

That's the most annoying thing about Microsoft's campaigns. Sure they may be slightly better in some areas than Google, but overall they are just as bad, or worse than Google when it comes to privacy.

Maybe I'd get it if those campaigns came from Mozilla or DuckDuckGo (even though they are still done in poor taste, and resemble too much negative political campaigns), but Microsoft? I just can't take them seriously in regards to that. Microsoft is throwing stones from a glass house, and they should stop.

jlgreco5• 13 years ago

> resemble too much negative political campaigns

Seriously, outside of politics they are the most negative ads I've ever seen. Even rival dishsoap or gym ads never get that extreme; nothing else compares. Did they actually hire a political advertising team or something?

declan• 13 years ago

It would be interesting to see a comparison of Bing search and ads privacy vs. Google's in the same areas. My hunch is that Microsoft would not come out ahead.

westoque• 13 years ago

I guess it's time for Google Hangouts to shine.

alfaomega2• 13 years ago

Why? I don't think it's encrypted in such a way that Google can't read it. References?

I don't think you can trust Google with your chat and docs as well.

From:http://www.wired.com/threatlevel/2010/09/google-spy/

>Google acknowledged Wednesday that two employees have been terminated after being caught in separate incidents allegedly spying on user e-mails and chats.

>David Barksdale, 27, was fired in July after he reportedly accessed the communications of at least four minors with Google accounts, spying on Google Voice call logs, chat transcripts and contact lists, according to Gawker, which broke the story Wednesday.

http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

SilvaR• 13 years ago

That actually shows that Google has privacy policies that are to be taken seriously by their own employees

Karunamon• 13 years ago

Shocking! You mean that nearly 3 years ago, a hosted service had employees that may have access to the databases of the services you're using?

The difference being that Google doesn't play at being encrypted end-to-end.

mtgx4• 13 years ago

No, but it would win huge bonus points if it did, over other chat apps. I think we all know Google won't bring OTR encryption to Hangouts, though, which is most unfortunate.

X43• 13 years ago

    * Can you please recommend a cross-platform alternative?

I only know of Gnome-Empathy/KDE-Telepathy and Pidgin that utilize XMPP's voice and video features.

I've found this: http://octro.com/octrotalk.php which lacks a linux client, but appears to be solid and has a web-client too.

sparkie• 13 years ago

https://jitsi.org/

X43• 13 years ago

I've tried jitsi for some time, but it crashes from time to time. It stores your passwords in cleartext just like pidgin does.

aclevernickname• 13 years ago

http://yate.null.ro fully replaces Skype functionality (client and server), and works under mac/windows/linux.

X43• 13 years ago

Thanks a lot for sharing!

I hope they do more marketing and seo. I didn't find Yate, even after extended web searches.

Congrats to the developers, I'll definitely try this one out!

rbanffy4• 13 years ago

What if someone passes an internal (poorly designed) Microsoft REST API that damages something when HEAD is called?

ancarda• 13 years ago

The main problem is most of my friends (even those who are programmers) cannot be bothered to spend the 20 minutes picking up alternative software so I'm stuck with Skype and Facebook as my primary means of talking to people.

yarou• 13 years ago

Convenience for privacy. :)

Bjoern• 13 years ago

This is yet another reason on my list why I welcome WebRTC so that we can get rid of problems like this.

rossjudson2• 13 years ago

Checking URLs passed in messages isn't incompatible with secure communication. It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them (and verify that they're not pointing to bad stuff, which is a very valuable service to provide to the vast number of readers).

We might find somewhere in Skype's ToS a reference to URL checking, for any URLs you send through the service.

The URL checks could also be anonymized.

betterunix2• 13 years ago

"Checking URLs passed in messages isn't incompatible with secure communication"

I guess that depends on your definition of "security," and perhaps of "practicality." Where I'm from (i.e. a grad student whose research is on practical secure multiparty computation), a practical system for checking URLs in a privacy-preserving fashion is still very much a research topic.

"It's easy enough to look at a text message that's going to be sent and break it into parts (URL and non-URL). Encrypt point-to-point the non-URL parts, and encrypt the URL parts such that the central servers can read them"

How is that secure? Now the third party knows what URLs you are sending in your messages.

"The URL checks could also be anonymized."

Sure, but that is not what you are seeing here. You would need a mix-net of some kind, one in which the users themselves are participating (to ensure that there is at least one honest party). It is technically possible...but you're not going to see it happen, not any time soon. With the FBI talking about building back doors into everything, what incentive is there for a company like Microsoft to actually make such a secure system?

When it comes down to it, most Skype users are too uninformed to even know how their software might betray them. On the other hand, the Justice Department could create plenty of difficulty for Microsoft if they failed to cooperate. Whose side do you think Microsoft will choose?

rossjudson2• 13 years ago

I'm not arguing that the communications stay theoretically secure. If there's any processing going on, they clearly don't. What I'm saying is that you break the message up into risk and non-risky parts, and the risky parts (URLs) can be treated differently. That different treatment is very valuable to the vast majority of users that don't care about complete security, but do care about having their systems compromised.

Which "betrayal" is worse -- Skype being able to look at messages, or compromised systems?

In terms of implementation, it's interesting to think about the design space.

wnight• 13 years ago

Actually, being able to tell anything about a message is incompatible with secure communications. Even the fact that there's a URL in there is more than I want you to know. It's all it would have taken to get shot in Iran in 2009.

There's a good way to do this though - give the users a local URL classifier and push updates to it. Then the client software is free to block dangerous URLs by default without hurting anyone's privacy. This works, and is used by many AV companies.

In fact, because of the way the system is centralized they could be sure the updates would reach users before another message did - providing the same level of safety as scanning the users' messages for them.

freewizard• 13 years ago

Not surprising at all. Skype has been saving chat logs for its China expansion since a few years ago. It's an existing function of their network and probably just a simple switch on their server.

anonymfus• 13 years ago

No, it was reported that Chinese version of Skype spies on client site. If somebody would get international version of Skype in China, it would not spy.

downandout2• 13 years ago

I'm not sure how this or the original article are "discoveries". Per the skype privacy policy, they are receiving and storing just about everything:

(from http://www.skype.com/en/legal/privacy/#retentionOfPersonalDa...)

Retention of Instant Messages, Voicemail Messages, and Video Messages (Skype internet communications software application only)

Your instant messaging (IM), voicemail, and video message content (collectively “messages”) may be stored by Skype (a) to convey and synchronize your messages and (b) to enable you to retrieve the messages and history where possible. Depending on the message type, messages are generally stored by Skype for a maximum of between 30 and 90 days unless otherwise permitted or required by law. This storage facilitates delivery of messages when a user is offline and to help sync messages between user devices...

From Section 8 of that same document:

Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links. In limited instances, Skype may capture and manually review instant messages or SMS in connection with Spam prevention efforts.

ballard2• 13 years ago

The article is fear-mongering with a drip of reality, too much like commercial news.

If someone didn't think all of their personal electronic interactions: SMS, gmail (if you still have one), banking info weren't being cursorily evaluated by echelon or other tinfoil hat system ... blackball the moron.

I'm interested in by-invite-only HN alternatives w/ lower noise and higher signal. (I'm no longer using HN as a primary news source and refuse to disclose which I do use.)

sinnerswing• 13 years ago

How about a GMAIL backdoor? oh no!! NOT GOOGLE!

Anyone remember this?

"A US government-mandated backdoor allowed China to hack into Gmail"

"In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access."

http://www.cnn.com/2010/OPINION/01/23/schneier.google.hackin...

GigabyteCoin• 13 years ago

Why is everybody so worried that Skype is visiting URLs you posted in their chat box?

They're probably just checking them for Malware was my first thought and is still my only.

DannyBee• 13 years ago

Because they are sending urls you type in back to MS and MS is storing them?

They also claim it's a secure communciations platform. If it was actually secure, why would microsoft be able to see it?

jlgreco5• 13 years ago

The concern is more that they are even able to.

pyre4• 13 years ago

If the URL is scraped from the message as it passes through Microsoft's servers, then Microsoft's servers have direct access to your chat text (i.e. not an encrypted channel from client-to-client).

If the URL is sent from the receiving client to Microsoft for analysis, then Microsoft has a list of all URLs that have been communicated to you via Skype.

Either of these scenarios chips away at / tears down the idea that Skype is a 'secure' communications platform.

Nux• 13 years ago

Like their latest ad on British TV says: "At Microsoft, your privacy is our priority!" :-D

tete• 13 years ago

Hey, there is an amazing alternative without setup time, P2P, open, standards compliant, ...

And best of all it's a shameless ad for a story submitted by myself. ;)

https://news.ycombinator.com/item?id=5729606

OldSchool2• 13 years ago

Nothing else explains why Microsoft would pay US $8 Billion for Skype. Profit margins are either exactly zero or near-zero for every call; this is not 1995 when telco call termination was 20x more expensive.

The simplest explanation is that reliable incumbent Microsoft was hired in some way to conveniently consolidate Skype. With as many channels through which Microsoft does business with the US government, favorable contract terms here and elsewhere could easily make the whole package worthwhile.

mtgx4• 13 years ago

NSA was already ready to pay billions of dollars for a Skype eavesdropping solution [1]. One could wonder if that's one way Microsoft wanted to recover some of the cost of their investment, and why they were so willing to pay twice as much as Google wanted to pay. I mean what company outbids another by 2x/$4 billion for a company with not that much revenue and profit?

[1] http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_...

pyre4• 13 years ago

  | One could wonder if that's one way Microsoft
  | wanted to recover some of the cost of their
  | investment

You could wonder, but it would seem difficult to hide $1 billion in revenue for a publicly traded company.

teamonkey• 13 years ago

> Nothing else explains why Microsoft would pay US $8 Billion for Skype.

Really? Nothing else explains why Microsoft wanted to buy talented development staff and software that was becoming the defacto name brand for video communication in homes and businesses, and which was taking market share away from Microsoft's own suite of communications solutions?

bede• 13 years ago

Has anyone developed a user friendly encryption layer that works on top of Skype? PGP or otherwise. Skype is useful, and it would be nice to have the option to use it for private conversations.

werter03886• 13 years ago

I tried testing sending a private link to my server to one of my friends over Skype after reading the first Heise article. To get a response from Skype, I contacted them. I think you might find the following very interesting:

"You are correct, Skype chats and conversations are encrypted. Your chat can only be read when you sign in using your Skype name and password. Not even Skype or Microsoft has access to your chat history. "

You can see the full transcript here: http://pastebin.com/bbiSWtrz

Skype backdoor confirmation

Related Stories