Https URLs posted in private Skype chats visited by Microsoft

Back before it could be tracked and recorded? When it was analog and switchboards?

Even if we had strict regulations, it would be all but impossible to prove impropriety of the snooping variety.

I think this is a problem we've always had that is being magnified by technology that allows us to realize that it is occurring.

I think we need to make a distinction between automated services and humans eavesdropping. I'd feel weird if someone was snooping in on my conversations and clicking my links, but on the other hand I very much appreciate the little bot that sits in my IRC channel and displays the title of any page linked. Both monitor the chat and access links, but I value one and feel weird about another. I don't think there's a way to truly make a distinction between the two though, and I think saying, "nothing is ever allowed to access your communications" removes the possibilities for a lot of added functionality (the link bot being just the base camp of the mountain of things that are possible). I think the better choice here is to ensure that the public has a way to communicate securely, and that our mental model of "trust usually, distrust as the exception" needs to move to "distrust usually, trust as the exception". This is similar to how sudo works in a way - we maintain a lower level of security usually for the convenience, then escalate only when needed.

Personally, I find this disgusting as well, and I agree that the lack of ethics in our profession is a huge problem, though fueled by user ignorance and apathy, but as much as I'd welcome an healthy backlash, I shudder to think of the lobbies that would "inform" the regulators when drafting such laws.

I would argue that the reason had to do with the fact that you couldn't encrypt, and you couldn't choose your provider. In a time when people could encrypt everything if they just cared, and when there are a ton of mostly independent ways to contact people and it's even easy to host your own, I wouldn't say that such regulations would be a good idea.

Your story is all about China. Skype for China is "special": https://en.greatfire.org/blog/2012/dec/china-listening-skype...

For governments from the set of countries that Microsoft has a presence in, or just from governments in general? I can't imagine they respond to DPRK requests, nor should they.

Microsoft can make such requests pointless if they choose to do so, by not having unencrypted data of people's private conversations in the first place.

Disclaimer: work for Microsoft in China but clueless about how Skype works here.

"Bob, if you should ever need to delete 100% of the content that I've created for you, you would follow this URL. Let me be clear, it will destroy USD $1,000,000 worth of goods."

1. There is probably something in the EULA for Skype that MS put in there to cover themselves with respect to this.

2. If there is not, it might be more effective to try and bring a multitude of small claims court cases against them. A tactic that worked against Dell in at least one instance: http://consumerist.com/2006/12/13/man-sues-dell-and-wins-by-...

"A spokesman for the company confirmed that it scans messages to filter out spam and phishing websites. This explanation does not appear to fit the facts, however. Spam and phishing sites are not usually found on HTTPS pages"

From the very next story down from the same publication:

http://www.h-online.com/security/news/item/Trojans-conceal-t...

"The company has reported that, since 2009, some malware has been concealing its data traffic by mimicking known instant messaging protocols or, to avoid detection, trying to camouflage its data traffic as HTTP or HTTPS. To achieve this, these trojans copy at least the header of the instant messaging protocol, leaving the remainder of the packets to carry the trojan's encrypted communications."

Looks like they're contradicting themselves here to score some click-bait headlines.

In order to comply to requests from law enforcement agencies, end-to-end encryption is not used by public companies offering communication services.

Case in point: I regularly bring up test web servers on my home server on weird ports, and Googlebot regularly finds them; I don't particularly care - anything I want to be private I password protect, but these are sites that are linked from nowhere. But there's any number of acceptable way it could find them: Some of the tools I use have default setups of Google Analytics that'd leak any urls I visit on them; I often click through links to other public sites from them, and any of those sites might leak the referrer.

So I agree with you that you should expect that URLs stay private.

But you can still have privacy expectations about the exchange of a public URL. E.g. someone might not like the thought that there is potentially a record that they're visiting certain embarrassing sites.

The reason there is a shitstorm over this is not that Skype is necessarily or even likely doing anything nefarious with the URLs, but that people had an expectation of privacy about their conversation that they then found out clearly is not being met.

If Skype/MS wants to scan every link, or retrieve them and put the contents on billboards in public spaces, there's nothing inherently wrong with either option. What is wrong is not realising that the actions they are taking are at odds with peoples privacy expectations and making sure to communicate what their actual expectation should be to users.

All the team use Gmail and one was using Chrome.

Furthermore they used test URLs containing hypothetical login credentials and showed how skype would get access to these.

The last troubling bit the author points out is that there seemed to be anomalous traffic to URLs shared in a skype conversation, where a microsoft IP seemed to attempt what they call a "replay attack".

I would be surprised if Microsoft wasnt doing this as it would leave users at risk.

Also, sending login credentials over HTTP GETs? That's a pretty contrived scenario. The HTTP HEAD might be a red herring - it might just be checking to see whether it redirects somewhere else/whether the URL has already been seen. Perhaps this URL didn't set off the spam/malware machine learning models to initiate a full crawl/human review.

"New Skype malware spreading at 2,000 clicks per hour to mine Bitcoins" https://news.ycombinator.com/item?id=5502028

One of the choice top HN comments:

"Why does Skype even have any clickable links in it at all if Microsoft can't be bothered to keep the obvious malware out?"

Another comment:

"Re the conclusion: to protect yourself, don't run an OS that will silently install software just because you clicked on a blue link in a program published by the OS vendor. Steve Ballmer should be jailed as an accessory for allowing this."

Damned if they do, damned if they don't.