Tag Info

Hot answers tagged

24

I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own Crypto. Especially if you aren't trained ...


18

Some random thoughts... Pidgin provides a lot of security features and support a lot of sec protocols and it provides strong encryption. It is Free and Open Source. Features include Automatically creates a public/private key pair for you upon loading the plugin. Automatically transmits your public key to other users. Supports 512 - 4096 bit keys. Saves ...


18

At the annual IEEE Security & Privacy conference in 2011, White et al. presented some very involved research on reconstructing encrypted VoIP sessions. The image below shows the overall architecture of the authors' approach. Although it works only for variable bitrate codecs (most common VoIP codecs are constant bitrate, e.g. G.711), the results are ...


13

This is incomplete. But hopefully of some use. http://imfreedom.org/wiki/IMessage and https://github.com/meeee/pushproxy (especially the docs section) have done some reverse engineering of apple's proprietary protocol. Seems that every apple device has a SSL/TLS client-side cert for authentication that setup to be known to apple's push server. This is ...


12

Questions I would ask myself before using skype for sending sensitive information: Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)? How are IM logs managed? Can you be sure that you have 'deleted' the password from the log? Even if logs are not being stored to ...


9

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


8

"A password" is not enough information to determine how it needs to be protected. What resources does the password grant access to, and what level of access? Skype uses reasonably strong encryption on voice communication--we think. It's closed-source, so what we know comes from documentation and protocol reversing. You can't look at their source code to ...


8

This question is hard to answer without knowledge of who and what you wish to be secure from. Does "practically secure" mean you are unlikely to be eavesdropped? If it does, then Skype (for example) is a good choice, due to it's encryption. Which country are you in? Some countries have 'lawful intercept' laws which require that authorised law enforcement ...


7

Public key cryptography can, in this case, be used to facilitate setting up a secure channel in which to transmit a symmetric key. Once the secure channel has been set up, it is not necessary to continue to encrypt and decrypt using the public/private keys. Instead, generate a symmetric key and use that to encrypt the traffic. You only have to distribute ...


7

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


5

There have been several suggestions that skype is indeed backdoored and evesdroppable. If your concerned about it because Microsoft is now the owner, there are plenty of other alternatives to Skype which I would suggest as the easiest and cleanest solution (besides, if MS is your competitor, why would you buy their services). Some of the alternatives like ...


5

In the Skype protocol there are also "proxy nodes" that relay traffic for you. Every Skype client can in fact become such a proxy node if the network reachability is good, especially in regard to firewall conditions. So you can't be sure if the peer IP address you are seeing is the one of your call partner or of a random proxy node. In the latter case you ...


5

Avaya have a quick checklist here which is a two page list which is broadly vendor neutral. Key first steps include: H.235.5 for H.323 signaling encryption SRTP* for H.323 / SIP media encryption (10 bytes overhead per packet) Standalone AES encryption can also be used for H.323 media encryption TLS for SIP signaling encryption SRTP for voicemail ...


4

Here is what I know: AIM/.Mac/ICQ (Oscar): supports optional SSL for client-server encryption. Jabber/GoogleTalk (XMPP): supports optional SSL for client-server encryption. Supports PGP. On these and other networks (MSN, Yahoo, GaduGadu), you should be able to use OTR messaging which provides simple, easy to use encryption. Both parties must have the OTR ...


4

http://www.cypherpunks.ca/otr/ is a plugin for several clients. I've used it with Adium on OS X and with Pidgin on Windows. It also works with Pidgin on Linux. The greatest part of this is that it is protocol independent -- you can use it to secure conversations on Google Chat, Jabber, AIM, etc.


4

Is it possible for the ISP or any middle point? If you meant is it possible for the ISP/middle point to decipher/decode/snoop on your chat, then the answer is yes. For unencrypted voice transports, all you need is a wireshark plugin to reconstruct the chat out of the pcap files. Check out http://www.panoramisk.com/151/analyzing-voip-with-wireshark/en/ ...


4

That Skype might be backdoored has long been a concern. See link below. https://ultraparanoid.wordpress.com/2007/06/19/why-skype-is-evil/ I also noted in a past review I did that the official, independent crypto review and the description gained by a reverse engineering team differed significantly. The latter had design flaws and working exploits. Also, ...


3

As far as I understand, SMP does not protect against MitM per se. The paper's authors clearly state, Suppose that Alice and Bob are chatting online using OTR and decide to run the SMP, but have not previously selected a secret and possess no channel more secure than their current conversation. They can still select an appropriate secret in this ...


3

You're misinterpreting the categorization. **[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]** [Message: HTTP/1.1 200 OK\r\n] [Severity level: Chat] Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...


3

I'm probably not very cool and don't use any of those currently but how about jabber / XMPP? This thread from 2009 seems to cover some of the differences and features with a healthy focus on security.


3

Skype sends information among 3rd party client nodes with a closed protocol. It makes no warranties about the security of its connection. I would suggest using something like OTR on top of your instant messaging medium. Beyond that, the usual, "is there enough risk to warrant concern" rule applies. Maybe it just isn't worth addressing in your case.


2

Since most protocols are proprietary, it's hard to tell in some cases. Most IM services don't employ secure communication, actually encrypting communication can be a huge issue in many countries. Most 3rd party IM clients support transparent encryption on top of the protocols. The only IM protocol that employs encryption that I know of is Jabber (and all ...


2

The most efficient way is to have client's exchange their RSA public keys and then generate random "session keys" to use for conversations with each other. This avoids multiple encryption and doesn't require the server to be able to decrypt the data. So if Jack is going to talk to Jill and Seth, Jack generates a random encryption key to use to talk to Jill ...


2

It is definitely possible to eavesdropp a voice conversation which goes over VoIP. However there are some programs like Skype that encrypt the voice data which makes it difficult and only difficult to tap into but not impossible. It depends on how well-equipped is the eavesdropper and how keen he is. If it is a government then I can make sure that it can, ...


2

As explained in RFC 3920 (section 5), a machine will send the "<starttls>" tag to indicate that it supports SSL/TLS, and then, when the final ">" of a subsequent "<proceed/>" XML element is sent and received, the underlying connection is immediately hijacked to begin a TLS handshake. The handshake consists in TLS messages (which are not XML at ...


1

The problem, as laid out in George P's linked paper, is that "vanilla" Diffie-Hellmann does not provide authentication as we generally define the term (the ability for each party to prove they are the real person or other entity they say they are, and for the other party to verify that proof). D-H at its core simply provides a secure means of key negotiation ...


1

I would send an insignificant amount like $100 using Western Union and state on the form that you send the money with that the person picking the cash up needs to present an ID. Then the bad guy will either present an ID or the funds will remain there for your friend in China to pick up at a later date.


1

There has been some success by people in trying to 'con the con-artists' into giving away vital pieces of information about where they are who they are. Depending on the legality of it, you could try and get them to execute a trojan on their PC (while playing along with their Con) and see if you can't get some information that way. It obviously isn't ...


1

Generally, asymmetrically encrypted chat handshaking starts out with exchanging public keys. Ideally you should have some mechanism for tying the key to the owner (think SSL certs and signatures) to prevent MITM attacks. Easiest to just use an existing system (such as SSL certs or PGP keys) to avoid reinventing the wheel. What signatures you decide to trust ...


1

This depends pretty much on the protocol you want to chat in, e.g. IRC, AIM, XMPP, Yahoo! Assuming you use Pidgin (an open source, multiplatform client), you can use the mentioned Off-The-Record (OTR) plugin. If, however, you are more familiar with IRC, mirc (Windows only) has Mircryption plugin, while X-Chat (multiplatform) has FiSH plugin. Basically, in ...



Only top voted, non community-wiki answers of a minimum length are eligible