Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but transmitting data.
Comparing with http, is there something like https for voice chat to avoid any possible spying in the middle? Is it practical to encrypt voice data?
At the annual IEEE Security & Privacy conference in 2011, White et al. presented some very involved research on reconstructing encrypted VoIP sessions. The image below shows the overall architecture of the authors' approach.
Although it works only for variable bitrate codecs (most common VoIP codecs are constant bitrate, e.g. G.711), the results are impressive. For details, have a look at the paper.
.
This question is hard to answer without knowledge of who and what you wish to be secure from. Does "practically secure" mean you are unlikely to be eavesdropped? If it does, then Skype (for example) is a good choice, due to it's encryption.
Which country are you in? Some countries have 'lawful intercept' laws which require that authorised law enforcement personnel can use to observe your traffic. See wikipedia - https://en.wikipedia.org/wiki/Lawful_interception. There has been press in this area - an example off the top of my head is that the Russian Government objected to the use of Blackberry equipment in their country, as it was unable to monitor communications. This was later resolved, as access was granted.
It is definitely practical to encrypt voice communications. Skype does this, I know for sure, although I am not sure if other services do. Bear in mind that, sometimes, who you talk to may be more revealing than what you talk about - it is definitely not a simple matter of 'is voice secure'.
Is it possible for the ISP or any middle point?
If you meant is it possible for the ISP/middle point to decipher/decode/snoop on your chat, then the answer is yes. For unencrypted voice transports, all you need is a wireshark plugin to reconstruct the chat out of the pcap files. Check out http://www.panoramisk.com/151/analyzing-voip-with-wireshark/en/
Comparing with http, is there something like https for voice chat to avoid any possible spying in the middle?
You can run your voice chat over SSL/TLS, that will mean that your data will be encrypted. However you won't be able to leverage the authentication part of TLS as unlike a Server-Client communication in websites, chat softwares are peer-to-peer. To leverage authentication part of SSL, you'll need client certificates which will enable authentication of the other party. If you don't have client certificate, then you never know if you are talking to the right person (a MITM can spoof to be the other party). Installing client certificates may be possible in an smaller (corporate) setup but may be difficult to achieve on internet where you can basically talk to any client.
Is it practical to encrypt voice data?
Its very practical to encrypt voice data. Many systems do it. Encryption-decryption overhead is no longer prohibitive to decide against it.
It is definitely possible to eavesdropp a voice conversation which goes over VoIP. However there are some programs like Skype that encrypt the voice data which makes it difficult and only difficult to tap into but not impossible. It depends on how well-equipped is the eavesdropper and how keen he is. If it is a government then I can make sure that it can, even with encryption in place.
In the digital world everything is possible!
Skype used to have a little padlock icon in the bottom-left of chat and call windows, whose tooltip said "This connection is end-to-end encrypted" or something similar. I don't know if that's still the case, but they used to brag about their security. I hope that they are encrypted.
