10

Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?

1
  • 4
    If you feel the need to ask, perhaps the answer for you is "no".
    – Iszi
    Mar 23 '11 at 23:28
14

Questions I would ask myself before using skype for sending sensitive information:

  1. Is the encryption truly end-user to end-user or is the data only encrypted between the user and Skype (thereby potentially giving Skype access)?
  2. How are IM logs managed? Can you be sure that you have 'deleted' the password from the log?
  3. Even if logs are not being stored to disk directly buy Skype, is the memory Skype uses for this non-pageable? i.e. could the password be placed into a page file without you being aware and hence become retrievable for local users?

Before satisfying these questions my own answer would have to be no.

4
  • skype protocol is P2P, so in theory it should just send traffic between the users, without using or logging data to skype servers, as it would make P2P pointless in this case. tho to answer above: 1: - noone really knows, 2: yes, you can be sure by just deleting the log file, 3: dont use paging in the first place...
    – Sigtran
    Mar 23 '11 at 12:57
  • 6
    actually - you can not be sure you have deleted the password. Points of issue: your skype logs, other user's skype logs, your windows logs, other user's windows logs, any logging on the intervening network.
    – Rory Alsop
    Mar 23 '11 at 15:18
  • 2
    Also restoration of the deleted logs is possible.
    – Simeon
    Mar 24 '11 at 13:19
  • actually you can delete all the logs in windows, by logging into a linux and deleting all the new files (need to do a simple dd from a previous known state). the rest: network logs, other user logs(??? why would your conversation be saved there) / etc at the very least going to require brutting AES, and that is going into "CSI mode of zooming into one pixel internet troll".
    – Sigtran
    Mar 24 '11 at 16:44
8

"A password" is not enough information to determine how it needs to be protected. What resources does the password grant access to, and what level of access?

Skype uses reasonably strong encryption on voice communication--we think. It's closed-source, so what we know comes from documentation and protocol reversing. You can't look at their source code to make sure they're not, say, using a flawed AES implementation that leaks key data.

Even if the protocol is completely secure, it's still operated by Skype Limited, a Luxembourg-based company, and owned by Silver Lake Investments, a Menlo Park-based tech investment firm.

So, to return to the beginning, what are you trying to protect? If it's the nuclear launch codes, over $10k worth of financial data, or Luxembourg state secrets, don't use Skype. If it's a user account on a domain that wouldn't interest a capital investment firm, a small European country, or a crime syndicate with the resources to sniff internet backbone traffic, Skype's probably ok.

3

Skype sends information among 3rd party client nodes with a closed protocol. It makes no warranties about the security of its connection. I would suggest using something like OTR on top of your instant messaging medium.

Beyond that, the usual, "is there enough risk to warrant concern" rule applies. Maybe it just isn't worth addressing in your case.

1

The other question is whether you really need to send a password (i.e. a shared secret) directly, or whether it would make more sense to establish an encrypted channel using a method that does not require a secure channel.

For example, if you can get positive confirmation that you are talking to the right person (e.g. by recognizing their voice on the phone), then having them generate an asymmetric keypair and read out the fingerprint of the key to you would be a sufficient trust path to initiate an encrypted communication afterwards, while an eavesdropper would not gain anything.

-1

According to some research (from 2013!) by the renowned german Heise Verlag, Skype (Microsoft) follows links in transmitted messages.

This article hast the details (in German)

If they follow links, they might also try passwords.

1
  • "Ooh, there's a password, let's try it on stuff!" -- I don't think that's a likely scenario. And it overlooks the more basic consequence of that research: Skype has access to your chats. That's enough to conclude that Skype is not a secure channel. The Skype FAQ on end-to-end encryption also indicates that Skype processes the content on their servers.
    – schroeder
    Aug 25 '20 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.