Hacker News Reader

Hacker News

Comment by skrebbel | Hacker News Reader

Parent Full thread

skrebbel

What alternatives do you suggest for business?

View on HN

Cisco Spark: www.ciscospark.com

It provides end to end encryption with customer owned keys.

High level data on the security model: https://www.ciscospark.com/content/dam/ciscospark/eopi/count...

Draft of the KMS technology behind it: https://tools.ietf.org/html/draft-abiggs-saag-key-management...

I think Snowden revelations showed Cisco in bed with the NSA, I wouldn't trust them if government surveillance is a concern.

There are many open source for teleconference these days, e.g. https://jitsi.org/ - I recall a few appearing on HN as well.

One of the points of the E2E security model used here is so that you don't have to trust Cisco.

Only if the enryption is done properly. Is that an open source project? Did someone you trust security review this?

There's a distinction between trusting a company not to look at your data when you hand it to them in plaintext, (Skype) and trusting them to have completely flawless, bugfree code that the NSA hasn't backdoored. (Dual_EC_DRBG)

You still have to trust that the encryption is indeed E2E as they claim, no?

I mean, whatsapp claims it has E2E encryption, but I've never checked...

https://whispersystems.org/blog/whatsapp-complete/

I'm not sure what parts you can verify, but I'm willing to trust the word of those at Whisper. Perhaps I'm naive but they seem to genuinely care about improving privacy for others.

This comment also shows that privacy is always based on trust. Trusting Cisco, Google, Microsoft, OpenSSL devs, Whisper Systems, whatever. You can decide who's more sympathetic, moxie, Zuckerberg, Nadella..

That was exactly the point I was trying to make when I responded to someone saying "well, with E2E encryption you don't have to trust them". Yes you do.

You still have to use the software you're running, and sounds like you are running Cisco's software.

From my time in Cisco, they take security VERY seriously. There was the story about Cisco devices being intercepted by the NSA in-transit to high-profile targets[0]. This was really bad press, especially since a lot of people assume that Cisco was complacent in the practice (there was no evidence as such, this was very likely the NSA intercepting the package in-route to the target). Many hardware companies (Cisco included) are trying to do verified-boot approaches where they can detect if the firmware or hardware is not genuine, there-by defeating these package intercept cases.

If you are a high-profile target, no matter what vendor or software you use, Five Eyes will do whatever is needed to infiltrate your network. Cisco is a large target just due to their volumes compared to most other solutions (you are more likely to see news of Cisco attacked due to volume of sales). But with that, Cisco will also dedicate resources to trying to defeat this type of attack.

[0] http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-...

Is this true: "The NSA has been sitting on a zero day exploit to remotely grab VPN keys from Cisco firewalls for FOURTEEN years." [0]

0. https://twitter.com/musalbas/status/777834235273027584

There is a separate thread here on HN about this[0], though most of the discussion is around the original editorialized title for the article.

If you read the "Exploitation and Public Announcements" section of the Cisco publication, it meantions the source was another CVE from a month ago[1].

[0] https://news.ycombinator.com/item?id=12540692

[1] http://blogs.cisco.com/security/shadow-brokers

They don't seem to think pricing is a relevant information (or something that should apply to everyone the same).

Wire, maybe. I haven't used it much, but it's supposed to be end-to-end encrypted and supports audio/video/text. No phone requirement either. Still a centralized service, though, so they get access to metadata.

I've been enjoying it quite a bit. I've been successful in getting a good number of my friends over to it; mainly in part due to it's attractive UI and good media support. YouTube and Spotify links preview well in Wire, and there's good gif support. Video calls were excellent quality.

Disclaimer: I worked for this company.

StarLeaf (https://www.starleaf.com/) is a great alternative for businesses.

https://switch.co works pretty well

It says nothing about encryption, so I assume it's not encrypted.

https://jitsi.org/

Looks like they changed their name, but heres their doc on encryption: https://storage.googleapis.com/switch_static/Cloud_Security_...

There is Skype for Business :)

If I'm not mistaken, it's a completely different product with the same name. It was lync for a long time, and they just basically changed the name but kept all the innards intact. I'm fairly sure it's on prem.

Yup, completely different products. Skype for Business is pretty much just a rebranding of Lync 2013 - for the longest time, the Skype for Business client was still calling itself Lync 2013 on it's about page. It's been pretty confusing, to be honest, since the two different Skypes are completely different products, talking different protocols that just barely communicate with each other.

Skype through Office 365 is also Skype for Business/Lync.

And before Lync, it was called Office Communicator.

It's an old, old, product. Before that it was Live Communications Server.

Anybody knows if it has something in common with the Ye Olde MSN Messenger?

First time I saw it I couldn't help to notice the similarities. Even the emoticons were the same!

They aren't related as products, despite being developed now by the same company.

There was an integration you could get (purchase, I think?) which allowed Lync to connect to the MSN network and chat to users of MSN.

With the Lync => Skype for Business rebranding, some of the original MSN-emoticons that used to work in Lync / Office Communicator have been removed. :-(

There's a hosted offering as part of the O365 suite.

Slack? Might not fully replace Skype as I don't think there is screen sharing. But for calls and chat, Slack does an outstanding job. Plus all the possible integrations with their API etc.

Slack has screen sharing through Screenhero

Is that any good? It seems to be quite weirdly not-integrated. (Separate accounts, apps and contact lists...)

It's not integrated, but it's fantastic. Have used it extensively for code pairing sessions, undetectable latency on the screen and crystal clear audio.

it is somewhat integrated, namely you can do `/hero @handle` and it will work. But SH doesn't work on linux, and it slows to a crawl when sharing with more than one person.

Still the best thing available if it works for your case.

Suggest Zoom if you need to share a screen to more than one person. I don't have a solution for Linux users.

There is a Zoom.us client for Linux.

Also appear.in works on Linux.

TIL on both counts! Thank you for educating me!

How does slack fix the concerns addressed above? Isn't it a closed-source app that routes everything through it's own servers?

Reply on news.ycombinator.com