Read this, then decide. I DEFINATELY will NOT use Skype.
Skype security and privacy concerns
Scott Granneman,
The big story in the news over the last week or so has been about gain. eBay agreed to purchase Skype, a peer-to-peer-based Voice over IP (VoIP) app, for a whopping $1.3 billion in cash and $1.3 billion in stock, with another $1.5 billion to come down the road if Skype met financial targets by 2008. VoIP has been in the news a lot in recent months, with Microsoft buying Teleo, Google rolling out Google Talk, Yahoo! acquiring Dialpad, and even AOL introducing a new service designed to let users make phone calls over the Net. Now eBay is joining the party by snapping up Skype.
I'm not really interested in why eBay bought Skype (although I'm pretty sure it's to make it easier for bidders to contact sellers) or whether or not the auction giant paid too much money or not (the general consensus seems to be, "Oh yeah!") for a company that has made $60 million this year but has yet to post a profit. I'm more interested in what the purchase of Skype means for security. What's that you said? Skype has many things going for it. Among the various software-based VoIP apps (which thereby excludes hardware-based offerings like Vonage from consideration), Skype probably works the best in terms of computer-to-computer, computer-to-land line, and computer-to-cell based calling. It's easy to set up and use, and it works on Windows, Mac OS, and Linux boxes. Skype also provides more than just VoIP, with IM and file transfer also available. I've used it quite a bit, and overall, I've been happy with its sound quality, as have many other people, given that the program has been downloaded more than 100 million times. It has more than 52 million registered users (among those 2 million paying customers), and well over 3 million people are online and using the program right now, as I'm typing this column.
But that doesn't mean that Skype is perfect. Far from it. Skype claims that it uses strong encryption to protect phone calls, IM messages, and file transfers:
"Skype uses AES (Advanced Encryption Standard), also known as Rijndael, which is used by U.S. Government organizations to protect sensitive, information. Skype uses 256-bit encryption, which has a total of 1.1 x 1077 possible keys, in order to actively encrypt the data in each Skype call or instant message. Skype uses 1024 bit RSA to negotiate symmetric AES keys. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates."
Here's the problem with that statement: since Skype is an insistently closed source program - and one that additionally uses a proprietary protocol, but I'll get to that in a moment - we have no way of verifying Skype's security. We simply have to take them at their word that their encryption works. For such an important program, that's quite a problem. I'm just not sure how safe I feel when Skype says, "Trust me - everything's going to be fine." Say what?! That's bad enough, but now Skype is going to be owned by eBay. I know that lots of people just loooove eBay. Be careful about the information you give them. Why? Well, it seems that there are three kinds of companies: those that fight for customers' privacy in the face of the demands of law enforcement; those that require some sort of official, constitutionally-mandated documents - like, oh, say, a warrant or subpoena - before handing over customer info to the cops; and eBay.
Think I'm being a little harsh on eBay? At the CyberCrime 2003 conference, Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay, had this to say to a group of law enforcement officials:
"I know from investigating eBay fraud cases that eBay has probably the most generous policy of any internet company when it comes to sharing information. We do not require a subpoena except for very limited circumstances. We require a subpoena when we need the financial information from the site, credit card info or sometimes IP information. ... So, that really opens the door for us. That means that what our policy is that if you are law enforcement agency you can fax us on your letterhead to request information: who is that beyond the seller ID, who is beyond this user ID.
I'm nearly speechless after reading Sullivan's comments. Think about what he's saying: if eBay receives a fax on offical letterhead (not that that would ever be faked, oh no) - just a simple fax, mind you, just a fax, unaccompanied by a court order - it will gladly fork over the following info about you, or any other eBay user:
* Full name
* User ID
* Email address
* Street address
* State
* City
* ZIP code
* Phone number
* Country
* Company
* Password
* Secondary phone number
* Gender
* Shipping information (including name, street address, city, state, ZIP)
* Bidding history on an item
* Items for sale
* Feedback left about the user
* Bidding history
* Prices paid for items
* Feedback rating
* Chat room and bulletin board posts
Understatement of the week: that is one hell of a list! It's long, it's scary, and it's troubling. So what do we have? Software that says it's completely secure, but without a good way to verify that claim, now owned by a company that will basically give up an astonishing amount of personal information about you at the slightest peep from the authorities.
So is there any alternative to Skype? Sure! In particular, I'm keeping my eye on Gizmo Project. Sure there are similarities: both are easy to use, install on Win/Mac/Lin, utilize encryption (although so far we don't kind what kind of encryption scheme Gizmo Project is using), and enable users to make calls to and receive calls from landline and cell phones (both are also closed source, although it appears that portions of Gizmo will be open sourced, so we'll be able to verify at least part of what Gizmo Project says about itself). However, Gizmo Project differs from Skype in several key ways. Where Skype uses its own proprietary protocol, Gizmo Project uses the open SIP (Session Initiation Protocol) standard (and it now supports the open Jabber protocol for IM). But here's the biggie: where Skype only allows free VoIP calls to other Skype users, Gizmo Project is committed to interoperability, so that it will be able to interconnect with any SIP-compatible VoIP system. Gizmo Project isn't anywhere near finished yet, but it is good enought to test, and if its current status is any indication, it's going to be one to contend with... especially if the new eBay Skype is as problematic as I'm worried it will be.
2006-06-22 08:48:36
·
answer #1
·
answered by Anonymous
·
8⤊
0⤋