Hacker News Reader

Comment by aashaykumar92 | Hacker News Reader

If this is true, I'm glad it reached the front page of HN. Given all the popular services out there which we use with just enough trust to put our privacy in jeopardy, I'm glad a hole is being exposed in such a big service. Hopefully Skype changes their verification practices.

View on HN

Skype is switching to use Microsoft Accounts, which have security questions and 2-factor auth. This vulnerability is only for people who haven't switched yet.

Haven't switched? You say that like Skype is actually forcing or even suggesting users switch. I just logged into my account. Aside from a 'Microsoft Accounts' button on the login screen, there isn't a single thing about MS Accounts let alone "you need to change your account!"

So, I'm going to wager this vulnerability affects about 99.99% of the users.

I've no idea if it's more like 10% of 90%, but I'm sure a lot lower than 99.99%.

People who used both Skype and MSN (Live Messenger) were shifted from MSN to Skype and now use their Microsoft account to connect to both lists of contacts in Skype. So it's not just for the geeky few who have set this up.

Second thought: last I checked, I could log-in to Skype with both my old username and my Microsoft account, but my Skype username didn't allow me to view MSN contacts. So if that's still the case, then I guess this would affect 100% of people, even those who have made the switch.

I thought it was just merging the accounts? I login with my skype name, and can talk with all my MSN contacts there. All the 'switch' does is add your MSN contacts, and give you a second way to log in. As far as I can tell, this affects everybody.

> You say that like Skype is actually forcing or even suggesting users switch.

Actually, a while ago, while logging into Skype, I got a clear invitation to switch to a Microsoft account.

I ignored it at the time, but I'm reconsidering in light of the mentioned attack.

Edit: There doesn't seem to be any switching possible; you can only merge a Microsoft account with a Skype account.

A lot of people don't want MS accounts. And for good reasons.

Now they have good reason not to want either.

How many years has microsoft owned skype now?

Just over 2 years, they bought it May 10 2011.

http://about.skype.com/press/2011/05/microsoft_to_acquire_sk...

Reply on news.ycombinator.com