Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 10 down vote favorite

Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?

share|improve this question
2  
If you feel the need to ask, perhaps the answer for you is "no". – Iszi Mar 23 '11 at 23:28

5 Answers

up vote 12 down vote accepted

Questions I would ask myself before using skype for sending sensitive information:

  1. Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)?
  2. How are IM logs managed? Can you be sure that you have 'deleted' the password from the log?
  3. Even if logs are not being stored to disk directly buy Skype, is the memory Skype uses for this non-pageable? i.e. could the password be placed into a page file without you being aware and hence become retrievable for local users?

Before satisfying these questions my own answer would have to be no.

share|improve this answer
skype protocol is P2P, so in theory it should just send traffic between the users, without using or logging data to skype servers, as it would make P2P pointless in this case. tho to answer above: 1: - noone really knows, 2: yes, you can be sure by just deleting the log file, 3: dont use paging in the first place... – Sigtran Mar 23 '11 at 12:57
4  
actually - you can not be sure you have deleted the password. Points of issue: your skype logs, other user's skype logs, your windows logs, other user's windows logs, any logging on the intervening network. – Rory Alsop♦ Mar 23 '11 at 15:18
1  
Also restoration of the deleted logs is possible. – Simeon Mar 24 '11 at 13:19
actually you can delete all the logs in windows, by logging into a linux and deleting all the new files (need to do a simple dd from a previous known state). the rest: network logs, other user logs(??? why would your conversation be saved there) / etc at the very least going to require brutting AES, and that is going into "CSI mode of zooming into one pixel internet troll". – Sigtran Mar 24 '11 at 16:44
up vote 8 down vote

"A password" is not enough information to determine how it needs to be protected. What resources does the password grant access to, and what level of access?

Skype uses reasonably strong encryption on voice communication--we think. It's closed-source, so what we know comes from documentation and protocol reversing. You can't look at their source code to make sure they're not, say, using a flawed AES implementation that leaks key data.

Even if the protocol is completely secure, it's still operated by Skype Limited, a Luxembourg-based company, and owned by Silver Lake Investments, a Menlo Park-based tech investment firm.

So, to return to the beginning, what are you trying to protect? If it's the nuclear launch codes, over $10k worth of financial data, or Luxembourg state secrets, don't use Skype. If it's a user account on a domain that wouldn't interest a capital investment firm, a small European country, or a crime syndicate with the resources to sniff internet backbone traffic, Skype's probably ok.

share|improve this answer
up vote 3 down vote

Skype sends information among 3rd party client nodes with a closed protocol. It makes no warranties about the security of its connection. I would suggest using something like OTR on top of your instant messaging medium.

Beyond that, the usual, "is there enough risk to warrant concern" rule applies. Maybe it just isn't worth addressing in your case.

share|improve this answer
up vote 1 down vote

The other question is whether you really need to send a password (i.e. a shared secret) directly, or whether it would make more sense to establish an encrypted channel using a method that does not require a secure channel.

For example, if you can get positive confirmation that you are talking to the right person (e.g. by recognizing their voice on the phone), then having them generate an asymmetric keypair and read out the fingerprint of the key to you would be a sufficient trust path to initiate an encrypted communication afterwards, while an eavesdropper would not gain anything.

share|improve this answer
up vote 0 down vote

Seems I'm a little late but I just want to share my opinion.

Nothing is secure enough to transfer passwords.

Passwords as a concept are meant to be memorized only. Storing/transmitting/telling someone a password instantly lowers the security of whatever it is protecting.

Generally you shouldn't need to give anyone a password he should create an account for himself or you should create an account for him.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.