Open Letter to Skype

[Renegade]

Yep. More privacy related stuff.

http://www.skypeopenletter.com/

Open Letter to Skype

From Concerned Privacy Advocates, Internet Activists, Journalists & Other Organizations


Thursday January 24th, 2013;
Skype Division President Tony Bates
Microsoft Chief Privacy Officer Brendon Lynch
Microsoft General Counsel Brad Smith

Dear Mr. Bates, Mr. Lynch and Mr. Smith,

 Skype is a voice, video and chat communications platform with over 600 million users worldwide, effectively making it one of the world’s largest telecommunications companies. Many of its users rely on Skype for secure communications—whether they are activists operating in countries governed by authoritarian regimes, journalists communicating with sensitive sources, or users who wish to talk privately in confidence with business associates, family, or friends.

 It is unfortunate that these users, and those who advise them on best security practices, work in the face of persistently unclear and confusing statements about the confidentiality of Skype conversations, and in particular the access that governments and other third parties have to Skype user data and communications.

 We understand that the transition of ownership to Microsoft, and the corresponding shifts in jurisdiction and management, may have made some questions of lawful access, user data collection, and the degree of security of Skype communications temporarily difficult to authoritatively answer. However, we believe that from the time of the original announcement of a merger in October 2011, and on the eve of Microsoft’s integration of Skype into many of its key software and services, the time has come for Microsoft to publicly document Skype’s security and privacy practices.

We call on Skype to release a regularly updated Transparency Report that includes:

More at the site.

[f0dder]

We call on Skype to release a regularly updated Transparency Report that includes:

-Renegade (January 25, 2013, 09:12 AM)

They should do that, but really it's a no-brainer - Microsoft has to comply with the patriot act.

While there might not have been (but I'd be surprised if there weren't) any backdoors in Skype prior to the MS purchase, there certainly were means to see exactly what was going on. And while it might not be official now, there's definitely regular backdoors in Skype now.

Who on earth would use non-opensource programs for secure communications anyway? 

(oh yeah. I need to kick myself in the hiney and get fSekrit brushed up for opensource release. Version3 de/serialization and PBKDF2 wasn't the funniest code to implement, so both those features are halfway-done at the moment).

[Tinman57]

They should do that, but really it's a no-brainer - Microsoft has to comply with the patriot act.

While there might not have been (but I'd be surprised if there weren't) any backdoors in Skype prior to the MS purchase, there certainly were means to see exactly what was going on. And while it might not be official now, there's definitely regular backdoors in Skype now.

Who on earth would use non-opensource programs for secure communications anyway? 

-f0dder (January 25, 2013, 12:15 PM)

Spot on.  The Patriot Act says that all communications will have back doors for government surveillance.  It's the New World Order that the U.S. is hell-bent on achieving.  It all started when a dumb-ass coke-snorting rich-boy president named GW Bush decided it would be a good thing to do.  Geeze, what an idiot....

[Carol Haynes]

Spot on.  The Patriot Act says that all communications will have back doors for government surveillance.  It's the New World Order that the U.S. is hell-bent on achieving.

-Tinman57 (January 25, 2013, 06:25 PM)

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

Who on earth would use non-opensource programs for secure communications anyway?

-f0dder (January 25, 2013, 12:15 PM)

Anyone who uses a phone (mobile or land line).

There is already concern that Chinese and Korean built mobile phones can potentially be used to collect data for their parent companies. Currently Samsung are working on buying Blackberry - which is causing some consternation in Canada from a security point of view!

[cmpm]

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

Yes.

Various provisions allowed for the disclosure of electronic communications to law enforcement agencies. Those who operate or own a "protected computer" can give permission for authorities to intercept communications carried out on the machine, thus bypassing the requirements of the Wiretap statute. The definition of a "protected computer" is defined in 18 U.S.C. § 1030(e)(2) and broadly encompasses those computers used in interstate or foreign commerce or communication, including ones located outside the United States.

https://en.wikipedia...wiki/USA_PATRIOT_Act

[Renegade]

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

Yes.

Various provisions allowed for the disclosure of electronic communications to law enforcement agencies. Those who operate or own a "protected computer" can give permission for authorities to intercept communications carried out on the machine, thus bypassing the requirements of the Wiretap statute. The definition of a "protected computer" is defined in 18 U.S.C. § 1030(e)(2) and broadly encompasses those computers used in interstate or foreign commerce or communication, including ones located outside the United States.

https://en.wikipedia...wiki/USA_PATRIOT_Act

-cmpm (January 26, 2013, 12:39 AM)

Or, the shorter answer:

[f0dder]

Spot on.  The Patriot Act says that all communications will have back doors for government surveillance.  It's the New World Order that the U.S. is hell-bent on achieving.

-Tinman57 (January 25, 2013, 06:25 PM)

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

Who on earth would use non-opensource programs for secure communications anyway?

-f0dder (January 25, 2013, 12:15 PM)

Anyone who uses a phone (mobile or land line).

There is already concern that Chinese and Korean built mobile phones can potentially be used to collect data for their parent companies. Currently Samsung are working on buying Blackberry - which is causing some consternation in Canada from a security point of view!

-Carol Haynes (January 25, 2013, 07:00 PM)

Yes, Carol - the owning company is .us based. It's sick... And THE reason .gov stuff should never be in a (public) cloud. Doesn't matter which country servers are in, if the company is .us based.

Also, landlines and cellphones, secure? Lulz :p

Oh, and wrt. blackberry, the device encryption keys were handed overt to the indian .gov - so much for security.

[Tinman57]

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

-Carol Haynes (January 25, 2013, 07:00 PM)

 Only if the Skype is routed through the U.S., which probably all calls are, but I wouldn't be a bit surprised to find they were doing it internationally.

[f0dder]

So if I use Skype in the UK to communicate with someone in the UK it is subject to the US Patriot Act?

-Carol Haynes (January 25, 2013, 07:00 PM)

  Only if the Skype is routed through the U.S., which probably all calls are, but I wouldn't be a bit surprised to find they were doing it internationally.

-Tinman57 (January 26, 2013, 07:12 PM)

Doesn't matter if the call is routed through the .us or not, all that matters is whether the company doing the service is .us based.

[Renegade]

A lot of countries extend their jurisdiction beyond their jurisdiction and completely ignore sovereign borders. This isn't unusual.

It's even more disturbing when they treat their citizenry like property.

[Tinman57]

A lot of countries extend their jurisdiction beyond their jurisdiction and completely ignore sovereign borders. This isn't unusual.

It's even more disturbing when they treat their citizenry like property.

-Renegade (January 26, 2013, 11:10 PM)

A lot of countries extend their reach beyond their jurisdiction and completely ignore sovereign borders.

  It's OK Renny, we knew what you were trying to say.   

[Renegade]

A lot of countries extend their jurisdiction beyond their jurisdiction and completely ignore sovereign borders. This isn't unusual.

It's even more disturbing when they treat their citizenry like property.

-Renegade (January 26, 2013, 11:10 PM)

A lot of countries extend their reach beyond their jurisdiction and completely ignore sovereign borders.

  It's OK Renny, we knew what you were trying to say.   

-Tinman57 (January 27, 2013, 06:26 PM)

Good point. I cynically muddled that up there.

[iphigenie]

Well considering all our POTS telephone conversations are being monitored and stored - enough companies sell this technology to governments - not sure what the fuss is all about. At least with skype *I* can keep a copy too

[Jibz]

http://www.schneier..../who_does_skype.html

[f0dder]

From a comment on the Schneier blog:

People rely on Skype for secure communications? Who are these people? They're using a communications tool freely given to them by a giant multinational corporate with close ties to the US government and known to implement a buggy proprietary security protocol and expecting to get secure and private communications? What world are these people living in?

-http://www.schneier.com/blog/archives/2013/01/who_does_skype.html#c1123566

That.

Discussing lolcats pictures, minecraft adventures, calling your parents, sexchatting midgets, whatever - that's all fine on Skype and similar services. But who in their right minds would do their terrorist bomb planning, drug deal scheduling, kidnapping details or secret evil megacorp plans on something not opensource?

No, I don't like the (pretty much official) .gov backdoors, but I had no illusions of Skype being secure before the Microsoft buyout, and anybody who did were naïve.

[raybeere]

But who in their right minds would do their terrorist bomb planning, drug deal scheduling, kidnapping details or secret evil megacorp plans on something not opensource?

-f0dder (January 30, 2013, 10:30 AM)

Of course, there aren't a lot of people who are in their right minds. I remember there was a guy in Florida who walked into a police station - to report that somebody stole his cocaine... For somebody like that, maybe Skype is a step up in security.

Edited to add: While I am not one of those people who subscribe to the "if you aren't doing anything wrong, you shouldn't worry about who's looking over your shoulder" theory, I do think, if you care about security, you need to worry about it yourself. Or, at the very least, decide who you're going to rely on. Relying on a government or big corporation to protect you goes beyond naive. For as long as I've used Skype, I've assumed it was only fit for conversations I wouldn't mind showing up on YouTube someday. Some may consider that overly cynical, but the point is that I thought about it. Putting all your trust in some mythical "Big Brother", be it governmental or corporate, is going to get you burned, sooner or later.

Since I'm not doing anything I have any special reason to conceal from the government (beyond a general preference to keep my life private), I'm more concerned with the corporate efforts to assemble data on everyone. Because, even if you "like" the company collecting it right now (and "liking" a corporation strikes me as a naive stance in the first place) you have no way of knowing who it will be sold on to, or how it may be used. And the notion of companies trying to peer inside my head for their benefit makes my teeth itch.

[f0dder]

But who in their right minds would do their terrorist bomb planning, drug deal scheduling, kidnapping details or secret evil megacorp plans on something not opensource?

-f0dder (January 30, 2013, 10:30 AM)

Of course, there aren't a lot of people who are in their right minds. I remember there was a guy in Florida who walked into a police station - to report that somebody stole his cocaine... For somebody like that, maybe Skype is a step up in security.

-raybeere (January 30, 2013, 12:04 PM)

We've had that in .dk as well, so it's not just an urban legend

[raybeere]

We've had that in .dk as well, so it's not just an urban legend

-f0dder (January 30, 2013, 12:09 PM)

It makes you wonder just how some people escape being eligible for the Darwin Awards so long...