Tag Info

Some random thoughts... Pidgin provides a lot of security features and support a lot of sec protocols and it provides strong encryption. It is Free and Open Source. Features include Automatically creates a public/private key pair for you upon loading the plugin. Automatically transmits your public key to other users. Supports 512 - 4096 bit keys. Saves ...

Questions I would ask myself before using skype for sending sensitive information: Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)? How are IM logs managed? Can you be sure that you have 'deleted' the password from the log? Even if logs are not being stored to ...

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...

This is incomplete. But hopefully of some use. http://imfreedom.org/wiki/IMessage and https://github.com/meeee/pushproxy (especially the docs section) have done some reverse engineering of apple's proprietary protocol. Seems that every apple device has a SSL/TLS client-side cert for authentication that setup to be known to apple's push server. This is ...

At the annual IEEE Security & Privacy conference in 2011, White et al. presented some very involved research on reconstructing encrypted VoIP sessions. The image below shows the overall architecture of the authors' approach. For details, have a look at the paper. .

"A password" is not enough information to determine how it needs to be protected. What resources does the password grant access to, and what level of access? Skype uses reasonably strong encryption on voice communication--we think. It's closed-source, so what we know comes from documentation and protocol reversing. You can't look at their source code to ...

Public key cryptography can, in this case, be used to facilitate setting up a secure channel in which to transmit a symmetric key. Once the secure channel has been set up, it is not necessary to continue to encrypt and decrypt using the public/private keys. Instead, generate a symmetric key and use that to encrypt the traffic. You only have to distribute ...

This question is hard to answer without knowledge of who and what you wish to be secure from. Does "practically secure" mean you are unlikely to be eavesdropped? If it does, then Skype (for example) is a good choice, due to it's encryption. Which country are you in? Some countries have 'lawful intercept' laws which require that authorised law enforcement ...

In the Skype protocol there are also "proxy nodes" that relay traffic for you. Every Skype client can in fact become such a proxy node if the network reachability is good, especially in regard to firewall conditions. So you can't be sure if the peer IP address you are seeing is the one of your call partner or of a random proxy node. In the latter case you ...

http://www.cypherpunks.ca/otr/ is a plugin for several clients. I've used it with Adium on OS X and with Pidgin on Windows. It also works with Pidgin on Linux. The greatest part of this is that it is protocol independent -- you can use it to secure conversations on Google Chat, Jabber, AIM, etc.

Avaya have a quick checklist here which is a two page list which is broadly vendor neutral. Key first steps include: H.235.5 for H.323 signaling encryption SRTP* for H.323 / SIP media encryption (10 bytes overhead per packet) Standalone AES encryption can also be used for H.323 media encryption TLS for SIP signaling encryption SRTP for voicemail ...

Here is what I know: AIM/.Mac/ICQ (Oscar): supports optional SSL for client-server encryption. Jabber/GoogleTalk (XMPP): supports optional SSL for client-server encryption. Supports PGP. On these and other networks (MSN, Yahoo, GaduGadu), you should be able to use OTR messaging which provides simple, easy to use encryption. Both parties must have the OTR ...

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...

I'm probably not very cool and don't use any of those currently but how about jabber / XMPP? This thread from 2009 seems to cover some of the differences and features with a healthy focus on security.

Skype sends information among 3rd party client nodes with a closed protocol. It makes no warranties about the security of its connection. I would suggest using something like OTR on top of your instant messaging medium. Beyond that, the usual, "is there enough risk to warrant concern" rule applies. Maybe it just isn't worth addressing in your case.

Is it possible for the ISP or any middle point? If you meant is it possible for the ISP/middle point to decipher/decode/snoop on your chat, then the answer is yes. For unencrypted voice transports, all you need is a wireshark plugin to reconstruct the chat out of the pcap files. Check out http://www.panoramisk.com/151/analyzing-voip-with-wireshark/en/ ...

Since most protocols are proprietary, it's hard to tell in some cases. Most IM services don't employ secure communication, actually encrypting communication can be a huge issue in many countries. Most 3rd party IM clients support transparent encryption on top of the protocols. The only IM protocol that employs encryption that I know of is Jabber (and all ...

The most efficient way is to have client's exchange their RSA public keys and then generate random "session keys" to use for conversations with each other. This avoids multiple encryption and doesn't require the server to be able to decrypt the data. So if Jack is going to talk to Jill and Seth, Jack generates a random encryption key to use to talk to Jill ...

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...

It is definitely possible to eavesdropp a voice conversation which goes over VoIP. However there are some programs like Skype that encrypt the voice data which makes it difficult and only difficult to tap into but not impossible. It depends on how well-equipped is the eavesdropper and how keen he is. If it is a government then I can make sure that it can, ...

I would send an insignificant amount like $100 using Western Union and state on the form that you send the money with that the person picking the cash up needs to present an ID. Then the bad guy will either present an ID or the funds will remain there for your friend in China to pick up at a later date.

There has been some success by people in trying to 'con the con-artists' into giving away vital pieces of information about where they are who they are. Depending on the legality of it, you could try and get them to execute a trojan on their PC (while playing along with their Con) and see if you can't get some information that way. It obviously isn't ...

Generally, asymmetrically encrypted chat handshaking starts out with exchanging public keys. Ideally you should have some mechanism for tying the key to the owner (think SSL certs and signatures) to prevent MITM attacks. Easiest to just use an existing system (such as SSL certs or PGP keys) to avoid reinventing the wheel. What signatures you decide to trust ...

This depends pretty much on the protocol you want to chat in, e.g. IRC, AIM, XMPP, Yahoo! Assuming you use Pidgin (an open source, multiplatform client), you can use the mentioned Off-The-Record (OTR) plugin. If, however, you are more familiar with IRC, mirc (Windows only) has Mircryption plugin, while X-Chat (multiplatform) has FiSH plugin. Basically, in ...

I personally use the mentioned plugin (OTR) for the pidgin IM client and several protocols, like MSN and GTalk - it even works with facebook chat. Both Adium and Pidgin are cross-platform IM clients. It you feel more adventurous - or don't want to use public IM protocols (good idea), you can roll your own XMPP server and use any number of xmpp clients to ...

The other question is whether you really need to send a password (i.e. a shared secret) directly, or whether it would make more sense to establish an encrypted channel using a method that does not require a secure channel. For example, if you can get positive confirmation that you are talking to the right person (e.g. by recognizing their voice on the ...