5

I was at a friend's house who uses VOIP on his own private WiFi for his phone calls. He made a call over VOIP (Voice Over Internet Protocol) that included the need to verbally state his credit card number over the telephone (he was ordering food).

After the call, he turned to me, and asked: "Is it safe to give out a credit card number over VOIP?". I told him I didn't know, but would ask here.

So the details are that he uses mainstream VOIP providers and his own WiFi (secured as best as WiFi can be secured). For this Q/A, let's assume that no one has hacked into his WiFi and that there were no problems at the restaurant from where he was ordering food.

Now, obviously, there is the risk that the person at the restaurant can easily steal his credit card information, but that's an assumed and understood risk.

The question here is: Is VOIP reasonably secure for this kind of use? Another way to put it: Does VOIP have about the same level of security as a landline, or does it have more, or less?

Improve this question
1
  • VOIP describes a very abstract method of combining technologies. It isn't a protocol. It isn't an implementation of a protocol. Commonly implementations are based on h.323 or SIP. It's only at the protocol/implementation level that this question can in any way be answered.
    – symcbean
    Dec 15, 2018 at 1:15

2 Answers 2

Reset to default
3

With VoIP there are more things happening, and thus more things to be hacked. While it is possible that he could be listened to, it is highly unlikely that someone would launch a targeted attack to get credit card numbers by intercepting VoIP. This is not to say that VoIP is inherently safe just that there are much easier ways for a criminal to get your credit card number and listening to VoIP is just impractical. Also, VoIP is usually encrypted via SRTP (Secure Real-time Transport Protocol) however an attacker could target the VoIP system and disable encryption.

Improve this answer
3
  • And if he is being specifically targeted, it's probably easier for a thief to tap into an analog phone line either through the demarc box on the back of his house or the telco junction box out on the street than to tap his VoIP calls. Back when long distance was expensive, I had someone tap into my demarc box to make international calls during the day when I was at work - nearly $1000 worth of calls in a month. The Telco replaced it with a locked box and that took care of the problem (they probably just moved to the neighbor's house)
    – Johnny
    Jul 30, 2015 at 23:50
  • Very True, also, there is lots of existing infrastructure for tapping analog phones.
    – Nick Mckenna
    Jul 30, 2015 at 23:52
  • Note that SRTP leaks some information due to the variable bitrate of VoIP.
    – forest
    Dec 15, 2018 at 3:16
-3

The security of a VoIP call depends on the phone you're using & VoIP the service you're using, so without knowing those details it's impossible to say how secure any given setup is. I've used VoIP for years because it costs so much less than a traditional phone line, but I don't know how for sure how secure my phone or VoIP service is.

But it really doesn't matter since I'm also using a top-rated VPN (Virtual Private Network), which gives me an encrypted internet connection. Also, my computer's IP address is blocked & replaced by one for whichever of the VPN's servers I'm using. I can choose from locations all over the U.S. or in other countries & even the closest server is over 200 miles away. (The farther away the server, the slower your internet connection).

So it always appears that my computer is far away from where it actually is & more importantly, my internet connection is encrypted. The VPN I use only costs $6/month & there are several in that general price range. I consider that very cheap security! Not impossible to 'hack', but extremely difficult (the best VPN's have military grade encryption) & certainly not worth the expense & effort to get something like a credit card number.

Improve this answer
2
  • 4
    Just to make it clear, using a VPN doesn't eliminate the problem, it just moves it down the way a bit. The connection is only encrypted by the VPN between your endpoint and the VPN's servers. From the there to to the opposite end-point you only have the same level of security as you would have had without a VPN at all. They certainly can stop certain attacks, but it should be clear that this isn't the same as an end-to-end encryption layer.
    – Xander
    Dec 14, 2018 at 20:00
  • 1
    "gives me an encrypted internet connection" - no, it really doesn't. It encrypts a portion.
    – schroeder ♦
    Dec 14, 2018 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .