Skype was claimed initially to be a secure communication, with one of its early web pages stating "highly secure with end-to-end encryption".[115] Security services were invisible to the user, and encryption cannot be disabled. Skype reportedly uses publicly documented, widely trusted encryption techniques: RSA for key negotiation and the Advanced Encryption Standard to encrypt conversations.[116] However, it is impossible to verify that these algorithms are used correctly, completely, and at all times, as there is no public review possible without a protocol specification and/or the program source code. Skype provides an uncontrolled registration system for users with no proof of identity. Instead, a free choice of nicknames permits users to use the system without revealing their identities to other users. It is trivial to set up an account using any name; the displayed caller's name is no guarantee of authenticity. A third-party paper analyzing the security and methodology of Skype was presented at Black Hat Europe 2006. It analyzed Skype and found a number of security issues with the then-current security model.In an interview, Kurt Sauer, the Chief Security Officer of Skype, said, "We provide a safe communication option. I will not tell you whether we can listen or not."[119] This does not deny the fact that the NSA monitors Skype conversations. Skype's client uses an undocumented and proprietary protocol. The Free Software Foundation (FSF) is concerned about user privacy issues arising from using proprietary software and protocols and has made a replacement for Skype one of their high-priority projects.[120] Security researchers Biondi and Desclaux have speculated that Skype may have a back door, since Skype sends traffic even when it is turned off and because Skype has taken extreme measures to obfuscate their traffic and functioning of their program.[121] Several media sources reported that at a meeting about the "Lawful interception of IP based services" held on 25 June 2008, high-ranking unnamed officials at the Austrian interior ministry said that they could listen in on Skype conversations without problems. Austrian public broadcasting service ORF, citing minutes from the meeting, reported that "the Austrian police are able to listen in on Skype connections". Skype declined to comment on the reports.[122][123] One easily demonstrated method of monitoring is to set up two computers with the same Skype user ID and password. When a message is typed or a call is received on one computer, the second computer duplicates the audio and text. This requires knowledge of the user ID and password.
The 2013 mass surveillance disclosures revealed that agencies such as the NSA and the FBI have the ability to eavesdrop on Skype, including the monitoring and storage of text and video calls and file transfers.[29][142][143] The PRISM surveillance program, which requires FISA court authorization, reportedly has allowed the NSA unfettered access to its data center supernodes. According to the leaked documents, integration work began in November 2010, but it was not until February 2011 that the company was served with a directive to comply signed by the attorney general,[29] with NSA documents showing that collection began on 31 March 2011.On 10 November 2014, Skype scored 1 out of 7 points on the Electronic Frontier Foundation's secure messaging scorecard. Skype received a point for encryption during transit but lost points because communications are not encrypted with a key the provider doesn't have access to (i.e. the communications are not end-to-end encrypted), users can't verify contacts' identities, past messages are not secure if the encryption keys are stolen (i.e. the service does not provide forward secrecy), the code is not open to independent review (i.e. the code is not open-source), the security design is not properly documented, and there has not been a recent independent security audit.[145][146][147] AIM, BlackBerry Messenger, Ebuddy XMS, Hushmail, Kik Messenger, Viber and Yahoo Messenger also scored 1 out of 7 points.
The 2013 mass surveillance disclosures revealed that agencies such as the NSA and the FBI have the ability to eavesdrop on Skype, including the monitoring and storage of text and video calls and file transfers.[29][142][143] The PRISM surveillance program, which requires FISA court authorization, reportedly has allowed the NSA unfettered access to its data center supernodes. According to the leaked documents, integration work began in November 2010, but it was not until February 2011 that the company was served with a directive to comply signed by the attorney general,[29] with NSA documents showing that collection began on 31 March 2011.On 10 November 2014, Skype scored 1 out of 7 points on the Electronic Frontier Foundation's secure messaging scorecard. Skype received a point for encryption during transit but lost points because communications are not encrypted with a key the provider doesn't have access to (i.e. the communications are not end-to-end encrypted), users can't verify contacts' identities, past messages are not secure if the encryption keys are stolen (i.e. the service does not provide forward secrecy), the code is not open to independent review (i.e. the code is not open-source), the security design is not properly documented, and there has not been a recent independent security audit.[145][146][147] AIM, BlackBerry Messenger, Ebuddy XMS, Hushmail, Kik Messenger, Viber and Yahoo Messenger also scored 1 out of 7 points.
0 comments:
Post a Comment