-2

How secure are Skype voice and video calls?

Obviously they do not use end-to-end encryption, so anything transmitted can be read and stored by Microsoft. But what about other 3rd parties? What do we know about the technologies used to protect the calls? Are there known unpatched vulnerabilities?

  • 3
    have you looked on Skype's own pages to see what they say about how they secure their service? – schroeder Dec 16 '15 at 15:40
  • 1
    Can I ask why people have downvoted this question? I'm happy to try and improve the question, given feedback. Or do people feel this is off-topic for security.stackexchange? – Martin Eden Dec 17 '15 at 15:50
  • If you hover over the down arrow, you will see that one of the proposed reasons for downvoting is "does not show any research effort" - in this case, it appears to be true because your accepted answer are quotes directly from Skype's own pages. – schroeder Dec 17 '15 at 17:55
  • Fair enough. I did read the Skype pages first, but didn't want to just accept their word for it, and I didn't have enough crypto know-how to be sure how good what they were claiming was. But given that people here were backing up the official line, and no one was reporting any exploits I figured that maybe that was enough. Thank you for letting me know about the "hover to see reasons" functionality. – Martin Eden Dec 17 '15 at 18:11
  • 1
    Skype in China is managed by another company (TOM), not Microsoft. If your account gets marked as "Chinese" for whatever reason (e.g. lots of use within China, created within China, etc.) or if you talk to someone with an account marked as such, your communication will be monitored by TOM, to comply with Chinese government regulations. If your account does get marked as Chinese, but you don't use Skype from China and don't live in China, you can contact Skype support and ask them to unmark your account. They will ask for proof of residence. – Szabolcs Nov 8 '16 at 12:28
4

Skype apparently had some known vulnerabilities, but most are old:

http://www.cvedetails.com/product/18729/Skype-Skype.html?vendor_id=8920 https://www.cvedetails.com/vulnerability-list/vendor_id-2302/product_id-4023/Skype-Technologies-Skype.html

You might also be interested in reading Skype's security page

http://www.skype.com/en/security/

Without going into too many [relevant] details, they do end up stating:

Here at Skype we use standard internationally recognized and accepted encryption algorithms that have withstood the test of time over many years of analysis and attacks. This protects your communications from falling into the hands of hackers and criminals. In so doing, we help ensure your privacy as well as the integrity of the data being sent from you to your contacts.

and

Skype uses well-known standards-based encryption algorithms to protect Skype users' communications from falling into the hands of hackers and criminals. In so doing, Skype helps ensure user's privacy as well as the integrity of the data being sent from one user to another.

Industry standard can likely be interpreted as: the only people that'll listen-in to your communications are potentially nation states or a group with lots of money. Here are the specs from their FAQ (https://support.skype.com/en/faq/FA31/does-skype-use-encryption):

Skype uses the AES (Advanced Encryption Standard*), also known as Rijndael, which is used by the US Government to protect sensitive information, and Skype has for some time always used the strong 256-bit encryption. User public keys are certified by the Skype server at login using 1536 or 2048-bit RSA certificates.

I think you'll be okay with Skype's stock offering, if you still don't feel secure you can also use Tor or a VPN.

-2

Skype is definitely compromised by the nation-state-sponsored advisory. This is the video by Zoz on DEF CON 22 that will clarify the facts

  • please do not post link-only answers - include the relevant details from the link in your answer – schroeder Dec 17 '15 at 17:52
  • also - this video does not answer the question - the OP already states that the issue is not at the server side (where nation states are camped out, according to the video), but the client-to-server channel – schroeder Dec 17 '15 at 17:53
  • @pe3z How is missing? I would appreciate a brief answer summarizing what's in the video right here than to watch it hour long. – Krishna Pandey Dec 17 '15 at 18:08
  • 1
    @K.P. The link already points to the part that I've mentioned and it's just 1 minute long. By the way, the part of the video is about the leaks that mention Skype to be one of the services that have been compromised by PRISM. More information: arstechnica.com/tech-policy/2014/12/… – Pandora Dec 17 '15 at 18:29
  • @pe3z My bad. It felt like start of video even at that section. – Krishna Pandey Dec 17 '15 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.