Hacker News Reader

Comment by electic | Hacker News Reader

Yea, the UI blows but one of the biggest concerns with Skype is that it is a leaky box. I know a lot of friends who have left skype because of government tapping. By tapping, I mean multiple governments all over the world seem to have unfettered access to every call and chat on the system.

When you are using the tool for business, that is a deal breaker.

View on HN

What makes you think comparable services are not equally compliant with intercept regulations?

E2E encryption. So whatsapp and FaceTime.

In principle, yes; in practice, most users are completely unable to assess whether the E2EE is effective in any way. How can you review the implementation does what the vendor says it does?

Say WhatsApp receives a request from some government saying they need the data. Period. WhatsApp complies by setting some flag on your account and now your client isn't doing proper E2E encryption anymore and it's all up to be intercepted. And when someone not on an intercept list goes to audit the network traffic, it all looks fine. Infinite possibilities here.

What makes people trust the advertised E2E encryption is really happening when they most need? Faith in these companies?

Peer review. And it's a moving target, skype used to be the recommended one back in the day, when it was decentralized. Right now openwhisper based systems are one of the better ones we have (so whatsapp and signal) that are sanely accessible with decent features.

Do you actually know the peers doing the review, or are you conducting the review yourself?

Did whatsapp make their e2e protocol open source ?

And even if they did, how do we now when they make you use the open source version of protocol and when they switch to a government-mandated (or cracker-pwned) protocol version for selected customers?

Indeed you would need to be able to have an open source client and be able to run your own server

And even there, to be absolutely sure, you'd have to have a well-sanitized environment (say, start from ensuring that when you build your application from sources, you know all the source code, and you know your compilers and libraries aren't pwned, and you know your hardware wasn't hacked by e.g. some BIOS-resident vulnerabilities.)

It's pretty depressing, actually. A determined adversary with intelligence-service level resources can get a lot done. Your main hope is to be such an insignificant target that they don't want to waste resources, e.g. expose 0-day vulnerabilities etc to get just you.

What alternatives do you suggest for business?

https://switch.co works pretty well

It says nothing about encryption, so I assume it's not encrypted.

https://jitsi.org/

Looks like they changed their name, but heres their doc on encryption: https://storage.googleapis.com/switch_static/Cloud_Security_...

Slack? Might not fully replace Skype as I don't think there is screen sharing. But for calls and chat, Slack does an outstanding job. Plus all the possible integrations with their API etc.

Slack has screen sharing through Screenhero

Is that any good? It seems to be quite weirdly not-integrated. (Separate accounts, apps and contact lists...)

It's not integrated, but it's fantastic. Have used it extensively for code pairing sessions, undetectable latency on the screen and crystal clear audio.

it is somewhat integrated, namely you can do `/hero @handle` and it will work. But SH doesn't work on linux, and it slows to a crawl when sharing with more than one person.

Still the best thing available if it works for your case.

Suggest Zoom if you need to share a screen to more than one person. I don't have a solution for Linux users.

There is a Zoom.us client for Linux.

Also appear.in works on Linux.

TIL on both counts! Thank you for educating me!

How does slack fix the concerns addressed above? Isn't it a closed-source app that routes everything through it's own servers?

There is Skype for Business :)

If I'm not mistaken, it's a completely different product with the same name. It was lync for a long time, and they just basically changed the name but kept all the innards intact. I'm fairly sure it's on prem.

Yup, completely different products. Skype for Business is pretty much just a rebranding of Lync 2013 - for the longest time, the Skype for Business client was still calling itself Lync 2013 on it's about page. It's been pretty confusing, to be honest, since the two different Skypes are completely different products, talking different protocols that just barely communicate with each other.

Skype through Office 365 is also Skype for Business/Lync.

And before Lync, it was called Office Communicator.

It's an old, old, product. Before that it was Live Communications Server.

Anybody knows if it has something in common with the Ye Olde MSN Messenger?

First time I saw it I couldn't help to notice the similarities. Even the emoticons were the same!

They aren't related as products, despite being developed now by the same company.

There was an integration you could get (purchase, I think?) which allowed Lync to connect to the MSN network and chat to users of MSN.

With the Lync => Skype for Business rebranding, some of the original MSN-emoticons that used to work in Lync / Office Communicator have been removed. :-(

There's a hosted offering as part of the O365 suite.

Wire, maybe. I haven't used it much, but it's supposed to be end-to-end encrypted and supports audio/video/text. No phone requirement either. Still a centralized service, though, so they get access to metadata.

I've been enjoying it quite a bit. I've been successful in getting a good number of my friends over to it; mainly in part due to it's attractive UI and good media support. YouTube and Spotify links preview well in Wire, and there's good gif support. Video calls were excellent quality.

Cisco Spark: www.ciscospark.com

It provides end to end encryption with customer owned keys.

High level data on the security model: https://www.ciscospark.com/content/dam/ciscospark/eopi/count...

Draft of the KMS technology behind it: https://tools.ietf.org/html/draft-abiggs-saag-key-management...

I think Snowden revelations showed Cisco in bed with the NSA, I wouldn't trust them if government surveillance is a concern.

There are many open source for teleconference these days, e.g. https://jitsi.org/ - I recall a few appearing on HN as well.

One of the points of the E2E security model used here is so that you don't have to trust Cisco.

Only if the enryption is done properly. Is that an open source project? Did someone you trust security review this?

There's a distinction between trusting a company not to look at your data when you hand it to them in plaintext, (Skype) and trusting them to have completely flawless, bugfree code that the NSA hasn't backdoored. (Dual_EC_DRBG)

You still have to trust that the encryption is indeed E2E as they claim, no?

I mean, whatsapp claims it has E2E encryption, but I've never checked...

https://whispersystems.org/blog/whatsapp-complete/

I'm not sure what parts you can verify, but I'm willing to trust the word of those at Whisper. Perhaps I'm naive but they seem to genuinely care about improving privacy for others.

This comment also shows that privacy is always based on trust. Trusting Cisco, Google, Microsoft, OpenSSL devs, Whisper Systems, whatever. You can decide who's more sympathetic, moxie, Zuckerberg, Nadella..

That was exactly the point I was trying to make when I responded to someone saying "well, with E2E encryption you don't have to trust them". Yes you do.

You still have to use the software you're running, and sounds like you are running Cisco's software.

From my time in Cisco, they take security VERY seriously. There was the story about Cisco devices being intercepted by the NSA in-transit to high-profile targets[0]. This was really bad press, especially since a lot of people assume that Cisco was complacent in the practice (there was no evidence as such, this was very likely the NSA intercepting the package in-route to the target). Many hardware companies (Cisco included) are trying to do verified-boot approaches where they can detect if the firmware or hardware is not genuine, there-by defeating these package intercept cases.

If you are a high-profile target, no matter what vendor or software you use, Five Eyes will do whatever is needed to infiltrate your network. Cisco is a large target just due to their volumes compared to most other solutions (you are more likely to see news of Cisco attacked due to volume of sales). But with that, Cisco will also dedicate resources to trying to defeat this type of attack.

[0] http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...

Is this true: "The NSA has been sitting on a zero day exploit to remotely grab VPN keys from Cisco firewalls for FOURTEEN years." [0]

0. https://twitter.com/musalbas/status/777834235273027584

There is a separate thread here on HN about this[0], though most of the discussion is around the original editorialized title for the article.

If you read the "Exploitation and Public Announcements" section of the Cisco publication, it meantions the source was another CVE from a month ago[1].

[0] https://news.ycombinator.com/item?id=12540692

[1] http://blogs.cisco.com/security/shadow-brokers

They don't seem to think pricing is a relevant information (or something that should apply to everyone the same).

Disclaimer: I worked for this company.

StarLeaf (https://www.starleaf.com/) is a great alternative for businesses.

'When you are using the tool for business, that is a deal breaker.' People say stuff like this all the time, implying that their business transactions are completely sacrosanct. At some point bog standard enterprise tech is going to be leaky someplace. I can't imagine the government would give a shot about my companies work. But then again I'm not the average paranoid HNer when it comes to this

Agreed, my logic is entirely the opposite. This would be a dealbreaker in my personal life, but why would I care what the gov't knows about my work life? Of course, I don't run the business...

The "government" like the "cloud" is just an abstraction.

The cloud is at the end someone else's computer. No, I'm sure Microsoft CEO isn't interested in sabotaging my business just like I'm sure the POTUS doesn't actively decide to kill innocent civilians. However, they make compromises (something we all do in engineering) and some of those compromises could end up with us as collateral damage.

What I'm getting at is even if all government agencies have purest of pure hearts, someone somewhere will eventually leave a door unlocked. Nobody can tell me with 100% certainty that this won't happen in the US and I trust their competence more than some outside contractor working for the Qatari emir.

This is my point of view on why we shouldn't have a dragnet. I don't have to argue that my government is evil. I don't even have to say my government is incompetent. But who in my government will testify for the other 200+ governments and their agents?

You don't know what the government cares about and what it doesn't. Over the last decade, many people used enterprise systems and hardware only to find out they weren't secure and the mundane information that traversed those systems were valuable to the government...and that they were compromised. [1]

You just don't know whose tapped the line, whose listening, and what systems your text is being indexed into. So reliable E2E is key.

[1] https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid...

If they want to listen to you they will listen to you, although you may make it more expensive for them to do so.

Unless you're using physical couriers and airgapped networks with TEMPEST protection. I say this unironically; these are facts people tend to brush away.

Reply on news.ycombinator.com