41

A couple of days ago I was having a conversation using Skype, then I wanted to share a link to a page with the interlocutor. I didn't want to let her understand the link content by just looking at the URL so I shortened it with Google shortening service, then I wrote her the link.

The service let me know how many times (telling also the referrer and the browser) the link has been clicked. I noticed immediately that someone located in U.S clicked the link (identifying as Chrome and www.google.co.in as referrer). enter image description here

(Firefox clicks are mine)

I asked to the interlocutor if she pressed the link (even though we're in Italy she may have some strange network configuration), but she ensured me that she didn't.

Should I suppose that someone is spying my Skype conversations?

Update 1 - Unshared links details

I just noticed that 9 days ago I created a link with the shortener, but then I did not share it with anyone, only me clicked it and this is the result of the Google charts: enter image description here

So can I exclude that the link I shared on Skype was visited by Google (if it was, why this link is not visited by no one?), or at least that if Google visits it they don't show their visit in the Details page?

(I have more than one link generated and not shared and no one of them result visited by Google or other except me)

Update 2 - All the shared links are visited by someone who shouldn't!

I also noticed that all the links I shared with Skype in the last 2 weeks have been visited at least once by a Chrome browser (with Google referrer), the most particular is this:

enter image description here

Total visits are 5, one is mine (the only Firefox), another one (with Chrome) is the click done by the Skype interlocutor (I'm pretty sure that she visited it just one time because the count of visits from Italy is 2 (my click and her's)).

Who made the remaining visits? If it was Microsoft, why the referrers are www.google.com.br and www.google.com and the browser identifies as Chrome?

Update 3 - About Skype URI preview

@Ankit Sharma said that it is possible that Skype URI preview functionality is looking at the link I shared, so I wrote a simple C# program to check this, here is the code:

var request = (HttpWebRequest)WebRequest.Create(theURL);
request.UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"; // This is the UserAgent he wrote in his answer
var response = (HttpWebResponse)request.GetResponse();
using (var sr = new StreamReader(response.GetResponseStream()))
    sr.ReadToEnd();

I run this code and then I checked the Details but it didn't record anything. To check if my program was buggy I tried changing the UserAgent to Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16 (taken here) and rerun it, then I checked at the Stats and it is now showing an Opera click. enter image description here

So I think that it is not due to Skype "functionality" that the suspicious clicks appear.

  • 21
    Skype scans your conversation and also trys to create previews of linked website etc. Googling would solve your question instantly. Skype is surely not for private and secure communication. – John Nov 20 '15 at 10:47
  • 6
    Note when you use the goo.gl website, after the URL is generated, it automatically shows a thumbnail of the page as well. Google's server(s) obviously have to hit the url to generate that. – billc.cn Nov 20 '15 at 14:00
  • 2
    I find it already unacceptable that a skype communication could very easily be spyed upon, i.e. by Skype/MS. Given that I think that this should be impossible to start with, technically, hence if privacy is key then it'd never even come to the question if it is done, the spying, as it's sufficiently bad it could. – humanityANDpeace Nov 20 '15 at 14:24
  • 4
    Yes, Skype isn't just "possible to spy on" (obviously, MS can do whatever they want with the traffic, and after acquiring Skype changed the peered nature of the network in fundamental ways), but it is in active use as a government collection resource. The problem with Skype as a mass surveillance tool from the perspective of a spy agency (or the tactical level, where the details matter) is that an agency trying to collect/scan all of Skype is like a small child trying to drink from a fire hydrant. MS automatically visits, indexes and records links passed in chat, though. – zxq9 Nov 21 '15 at 10:46
  • 3
    Why are you using Skype if you give half a rat's ass about privacy, anyway? – Tobia Tesan Nov 22 '15 at 13:24
45

Given the information you have provided I'd say that it's google shortener visiting the url to check it for security purposes: "Our spam detection algorithms are automated, and routinely disable suspicious goo.gl short URLs" see here.

Back in 2013 it came out that Microsoft monitors skype conversations for HTTPS urls. It then visits these urls purportedly for "preventing spam, fraud or phishing links" (more info here, or on google), so regardless you need to be aware that skype is not suitable for secure text conversations.

UPDATE

So I've just seen your updated information in your question.

I'd still say that at some point known to themselves, something at google will probably hit the URL, either for indexing or security. However thinking about it I wouldn't have expected any of the google's own crawlers/bots to appear in their own statistics; as they're not clicks and they wouldn't want to affect the statistics they present you with, and the bot(s) would visit the destination of the shortened URL, not the shortened URL itself.

If the original shortened URL led to a system under my control I'd now be looking for web server log files to see what requests have been made.

There's always the possibility that there's something else on your machine, or on the machine of the person you sent the URL to, which is responsible for the activity. That could either be something benign or not.

Another thought is that since 2013 Microsoft have changed how their spam preventing system works, but I can't see it having a chrome user agent string!

  • 2
    Browser plugins may spy on visited URLs as well. Google toolbar used to generate apparent traffic, and it wasn't filtered out of Analytics. – Alfred Armstrong Nov 20 '15 at 16:19
  • @AlfredArmstrong The links I generated (and visited myself) and not sent didn't show any suspect traffic, so it is not a plugin of mine. And the link I shared on Skype showed suspect traffic even if the interlocutor never visited them, so it is neither a browser's plugin of the other one. – Matteo Umili Nov 20 '15 at 16:45
  • +1 For that. However you said I wouldn't have expected any of the google's own crawlers/bots to appear in their own statistics. I believe aside from development bugs and leaks; these things happen even with Google - Furthermore, Google use a range of CDN servers and network services aside from the bot systems. So something definitely has scanned and jumped on the link. Maybe a software tool in the woman's (interlocutor) browser too such as those annoying advert spyware services that scan all links and return data back to the user. – TheBlackBenzKid Nov 21 '15 at 16:16
14

When you use Google's goo.gl service for link shortening, the URL becomes known to Google. This gives Goolge the opportunity to index the content for their search engine. Remember Google's privacy policy which basically states "we will data-mine every single bit of information you make available to us".

Apparently it then appeared as a search result for a user of google.co.in who lives in the United States and uses Chrome.

  • 4
    Please check the update on the question that may exclude Google from being the one who visited the link – Matteo Umili Nov 20 '15 at 14:26
3

Recently I too noticed strange hits to a private page link sent via skype. Sometimes 10-15 at a time. On checking web server logs, I found its skype's spider bot.

Any link you post in skype chats, the spider bot tries to fetch preview of website ( not sure why, may be spying links or storing website snapshots)

If you check web server log (since i had private server), you will find the IP and User Agent of spider like

104.209.188.XXX
Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5"
IP address country: ip address flag United States

IP address state: Washington
IP address city: Redmond
IP postcode: 98052
IP address latitude: 47.6801
IP address longitude: -122.1206
ISP of this IP [?]: Microsoft Corporation
Organization: Microsoft Azure

  • I updated the question adding a test to check if Skype is responsible of the click and it appears it isn't – Matteo Umili Nov 23 '15 at 8:43
1

To be honest you're probably looking at a Googlebot indexing the link.

Google Spiders are programs that discover and update web pages by crawling the internet, looking for content to add to the Google index. In other words, you needn't worry - especially as you shortened the link through Google itself. If you were worried about someone reporting you for the content or the link was to a private link access only youtube video, try using TinyURL - they may still look at the link but may have less reason to - and almost definitely won't have spiders indexing there links

-1

It's not like the NSA has a cable plugged onto every international server, downloading the data that each one of us send through the internet. In any case, the message would pass a filter and if it contains certain elements, they might get a copy of your conversation for whatever purposes, from marketing research to "terrorism investigation" or whatever their excuse is.

Microsoft and Google are two known huge "leaky baskets" that will extract all the information they can from your daily activity while you are using their products, so they can analyze it and sell it to third party companies that want to advertise their products to you. You, in fact, agree with that when installing or using their software, as it's well stated into their terms of service and EULAs. That doesn't mean they click on every link you send or watch all the photographs you send, they simply have "bots" that gather all the data they can, by performing statistical analysis and "data mining" of everything you do with their products, including searches, mails, etc.

If you are really really concerned about anyone sticking his nose into your conversations (let's say you own a huge corporation and you don't want anyone leaking your secret product), you should start using "ciphering" instead. And by that I don't mean just using "Tor". In fact you should avoid anything that is public and is well known by any agency. Even the most basic and ancient forms of cryptography can work well in these situations. As well as alternative communication channels, if possible.

But if you are a regular user, you should not worry that much anyway. It's not like there is a person watching every picture you post and laughing at it, you know... Most common case scenario is, you tell a person you want to buy a car through skype, and then your ads start showing cars for sale while browsing through bing.

  • 3
    Source for your " two known huge "leaky baskets"" and more please? – Ave Nov 21 '15 at 23:17
  • For instance, many people complained about Windows 10 being basically "spyware": bgr.com/2015/07/31/windows-10-upgrade-spying-how-to-opt-out About google, you can read their privacy policy: google.com/policies/privacy They explicitly mention how they gather your personal data just by signing in, and how they use that data. – NotTheNSA Nov 21 '15 at 23:20
  • 6
    “In fact you should avoid anything that is public and is well known by any agency.” — Not…really? As far as crypto goes, you should use things that are well-known, open-source, and well-established enough that many people have tried and failed to break them. – Blacklight Shining Nov 22 '15 at 0:49
  • Public key cryptography is very well known to a lot of agencies, and yet I don't think it should be avoided. And it may interest you what the NSA has to say about TOR: theguardian.com/world/interactive/2013/oct/04/… – szczurcio Nov 22 '15 at 15:48
  • 1
    @szczurcio there's something soooo satisfying reading the NSA complain about some software/technology resisting their spying efforts. – André Borie Nov 22 '15 at 16:45

protected by Community Feb 1 '16 at 10:21

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.