Is not installing skype a better option than installing skype with a special group & user?
As always in computer security, not installing something is more secure than installing something.
Whether or not you choose to install skype is a cost-benefit exercise: do you believe that skype is doing something dangerous - and how much are you prepared to accept that it might, versus the benefit of using the service?
This is a decision only you can make - my only comment would be that just because Skype is obfuscated, doesn't mean it is malware. Moreover, you're trusting a huge number of other packages on the system as it is.
Now, onto some technical observations. Whilst it is certainly possible for an engineer to obfuscate the machine code in their executable, it is much harder to compensate for the fact that the binary must make system calls to the kernel to get things done. This means that you can analyse these calls, and look into them. As I understand it, skype resists ptrace (and so strace), but you could easily build a LKM hooking the system calls you wish to dump - that Skype cannot stop. From there, you could audit exactly which files skype open()'d, and so on. I've never done it - and there'd be a fair amount of coding involved (you'd get all open calls and need to filter for a given set of PIDs), but it isn't impossible.
The next technical observation to make is that the Vanilla skype presentations attached to your first link have documented the process of attempting to remove the copy protection from Skype - so I think it's unfair to say "nobody knows what it does". We have a reasonable understanding, albeit with gaps.
To answer your question - running Skype as a separate user will provide you a level of security against skype evesdropping on your documents under the following caveats:
- You never hand it elevated privileges.
- There are no known or unknown security vulnerabilities present anywhere in any executable on your system that skype may run to escalate its privileges or obtain your privileges.
The reason for these should be straightforward - if you run Skype as root, it can do anything. If you have a vulnerability, Skype may be able to exploit it, assuming Skype is malicious.
I've looked at this myself, and personally I suspect that the high level of obfuscation in Skype is used primarily to protect the intellectual property used in Skype - making it difficult to reverse engineer it - rather than to hide anything nefarious. After all, a reputable software vendor distributing nefarious code who is detected risks damaging their reputation considerably.
