How Skype fixes security vulnerabilities

This narrow view of what constitutes the system shows that MS Security is seriously flawed. If you run hosted software you have to consider the security aspects of the total system, including support and other human factors. Seems like MS is stuck in the mindset of shrink-wrapped software.

It's the same issue as in any big system - people on high enough positions are isolated from all the crap normal users have to deal with. If you can interrupt their business call though... I expect the fix will be coming soon.

I contacted their chat support to tell them about it. The person on the other end was insisting that I might be using another Skype account where my other contacts are. Which of course I ain't since I'm not that stupid. He then suggested the stupid bullshit Tier 1 support usually does, like reinstalling Skype. I did as asked.

Then he asked me for remote control of my PC which I refused, because I have sensitive data on my laptop and I'm on a MacOS anyway. I then asked for my issue to be upgraded to a higher-level tier, because losing my contacts is unacceptable. Then he made an accusation that I haven't reinstalled Skype as asked and that I'm probably using two accounts, at which point I gave up.

Anyway, Skype sucks, it's been a week since I've lost most of my contacts which I've been collecting for about 7 years or so and their support is useless.

If you're relying on Skype for your business, stop doing that ;-)

Finding a replacement isn't easy, but I've used Wire (wire.com) for a year now and find it good enough feature-wise, and excellent security-wise. It has its quirks and can be a resource hog at times (the desktop app uses Electron IIRC), but it's worth switching from the security disaster that is Skype.

I used it 10 years ago, and it was great - or at least pretty good, compared to the other options. Video calls, screen sharing, chat.

But it had a number of problems. Mostly surrounding using it on multiple devices, making it very hard to keep track of what has and has not been read. Log onto Skype on a device I have not used in a couple of days, and "unread" messages show up - messages I have already read.

Over the past 10 years, none of the issues that I care about have been addressed. But we did get some garbage integration with facebook and nice emoticons. They added features nobody wants and have not addressed the problems. It is maddening.

It makes me sad. But it is unfortunately still the standard when you deal with non-technical people, so I keep using it... :(

The only way to beat it would be to have another communication solution which can be used as simple as Skype is (for any age, technical literacy, etc.).

Original submission by author: https://news.ycombinator.com/item?id=13225939

They fixed it, but boy that was a doozy.

This is bothers me alot. My mom got a call from this guy pretending to be MS employee couple of weeks ago. He told her that the PC has been infected by virus and MS has been notified and he is helping her to resolve the issue. For a person like my mom who is not much of tech savy person, the chances are really high to fall for this. Fortunately, she told that guy to call her back later, because she didn't know the administrator password.

Then, I saw what I was expecting as the very first line in the article.

I added the interviewer in my contact list, but we were never able to start a video conference. We did it by phone instead. I did not have the job. Thanks Skype. Not to mention the interviewer had Skype Pro.

Not to mention the intrusive ads.

I've no idea if this is real or not, but if it is, it's pretty damning for Microsoft. I hope the author goes to court and wins!

Still. the other exploit mentioned, the one not "patched" - This same kind of mass-reporting system exploit is usable in all manner of online forums and services - heck, HN's own flag feature could get pretty close (we just have some very hands-on moderators and an okay community)!

As for not restoring something when contacting support... I can understand why. It's _better_ this way, since then no malicious party who is _actually_ spamming with Skype accounts can retrieve an account using only a bit of social engineering! Instead they need to roll up new emails and new accounts. (And think of it this way: If a malicious party is abusing the system to get your account blocked, how will they know your new account to repeat the procedure? They shouldn't.)

Yes. It's a pity that the abuse reporting system is itself vulnerable to abuse, but... aren't most? Given Skype's massive userbase, putting the user reporting function behind a mechanical turk... the rate at which they'd need to comb through ban requests would seem to make fatigue (and thereby false positives which would result in the same outcome as now) inevitable. The only interesting way I've seen this abuse-system abuse handled in recent years was the League of Legends tribunal system[1], where they effectively handed penalty decisions to the community at large and let them come to a consensus. Though I don't know how well it worked and, honestly, that system seems just as game-able as the automated report button itself. In fact, it feels analogous to a Sybil attack[2] in the crypto world - get enough aligned malicious identities in a decentralized system and they effectively control it. The only "fix" is making identity creation too expensive to make gaining a controlling share of the identity-space prohibitive (which would entail making account creation difficult) - I feel that this is _directly at odds_ with account creation speed and this user acquisition for a service like this, so I can not fault Skype for falling on the middleground that they have.

[1]http://forums.na.leagueoflegends.com/board/showthread.php?t=... [2]https://en.wikipedia.org/wiki/Sybil_attack