Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation on how it works in recent versions? For example, whether it stores a plain text password, or how easily it can be retrieved. More likely unofficial information, from people interested in the subject (for example, you would get surprised how secure Windows Credential Manager actually is). But it would be good if Microsoft documented how it works somewhere, so we can feel confident that our main account is safe.

My concern is that the Microsoft password is just too important, giving access to all Microsoft services, while Skype account is more specific. I do not want my main password having any chance to get compromised just because I do not want to keep typing a password all the time in Skype. Unfortunately, Microsoft have not copied Google's application-specific passwords yet. That allows creating secondary passwords for Google account, protecting your main password from getting stored anywhere.

Not stored securely, but stored at all

Please note, I am not worried about whether the main password is stored insecurely, but stored at all. Whatever encryption is used, you can simply copy whole Skype profile without decrypting anything, and possibly with some additional hacking, you could at least impersonate the user on Skype (assuming that a compromised stored password will generally mean a compromised computer, at that point it should not be that hard).

Even so, it could be possible that some security flaw was explored by the attacker in order to elevate the privileges from the Skype account and get access to the main Microsoft account. I assume their security is good regarding this, but it becomes much more threatening if the main account password or some sort of authentication token is stored, in any form (again, you can simply reuse the encrypted data in another profile or in your desired hack).

share|improve this question

migrated from superuser.com Oct 10 '13 at 4:12

This question came from our site for computer enthusiasts and power users.

    
Unfortunately you will not likely get an affirmative response on this, because the companies involved would never publicly share this information as it pertains directly to their security configuration. I would be very surprised to find that either of them stored your password as anything but a hash, but who knows how strong their algorithm is. If the algorithm is weak, you can get more protection via long, very random, very complex passwords, but these days, even those will fall to rainbow tables. –  Frank Thomas Oct 10 '13 at 5:01

1 Answer 1

It is really hard to judge its percentage of security with a couple of queries.

Obviously none of the users who gives "Remember password" option or automatic authentication wants their password to get compromised.

If you really do not want your Microsoft services to be accessed by any other application, then i suggest you consider not merging it with other applications.

And remember that just because of merging your Microsoft account with Skype doesn't mean that your Microsoft account is made less secure. It means that you can have a centralized place where you can manage and access both of your accounts.

Microsoft might not have implemented Google's application-specific passwords yet. But that doesn't make it vulnerable for your password since Microsoft has it's own encryption system which uses some of the top most security algorithms (I do not want to go deeper as it may be off topic).That proves that your password or any other sensitive information will be hashed using an advanced encryption system and secured.

And to answer you question, Yes it is secure (again, not in terms of percentage).

share|improve this answer
1  
"top most security algorithms", what do you mean by throw? Do you mean best, most secure... Microsoft invents there own crypto and then keeps the details secret, therefore it is not as well vetted by the security community. There could be make weaknesses in the latest NTLM algorithm for example. –  ewanm89 Oct 10 '13 at 7:22
    
@ewanm89 Well asked.I referred it as one among the best security algorithms because Microsoft is one of the firms that invents their own crypto and maintains them as a top secret(as you mentioned). Keeping it for themselves is obviously for security reason. But that doesn't mean that they are outdated. They have a dedicated team which constantly researches and implements the changes in their crypto according the latest ones. i would not say that it can never be broken, but it is very hard to break into their security system(very tiny probability of getting exploited). –  Ebenezar Oct 10 '13 at 8:47
1  
Inventing your own and keeping it hidden even with a good group of cryptographers is not a good thing. All cryptographers make mistakes, this leads to axiom 1, don't invent your own crypto, just ask don't about ps3 issues. The fact they won't publicly disclose is suggesting they are relying on security through obscurity, axiom 2, security should rely entirely on a single secret key not that the whole process is kept secret. –  ewanm89 Oct 10 '13 at 8:57
    
@ewanm89 I agree that it has to undergo a thorough check by the security community so that the unknown issues or security loopholes can be found and fixed. I guess one of the reason that reason they keep the whole thing as a secret is they don't want to risk it's security rather than keeping it secure, which is again not the best way in security especially for a long term process. –  Ebenezar Oct 10 '13 at 9:07
    
I'm sorry, but you haven't really answered the question, not even close. And to answer your answer, no, it is not a boolean question. It is obviously argued to be secure by them, but without mathematical proof, the reason why I rather asked for details. I will stop here, I don't even want to start objecting all of your points. My last edit indirectly did a bit: go check how insecure Windows Credential Manager is, for example, and object to my point on how useless encrypting a stored password can be. I'm sorry, but I would vote your answer down if I could. –  Renato Silva Oct 11 '13 at 3:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.