Skype with care – Microsoft is reading everything you write

Ed Bott just doesn't get it, does he?

Skype was originally marketed as having end-to-end encryption. Now, we know that since Microsoft bought Skype they've added wiretapping support, which works by making themselves a man-in-the-middle. They claim they only do this temporarily for people they are actively wiretapping.

This, however, shows that Microsoft regularly MITMs you, for the purpose of evaluating whether links are dangerous. This means that basically all of Skype's former privacy claims are no longer true. They simply regularly look at your unencrypted traffic, which means that they are a target for attackers, governments, and pretty much anyone who wants to eavesdrop or read your messages.

That article is very dismissive and pretty flimsy. "A single experiment"? No, it was replicated by multiple people. I’ve concluded that the reason for the mysterious visit is almost certainly innocent.... I’m reasonably certain that address is part of Microsoft’s SmartScreen infrastructure. First, that's not very reassuring. The data should not be readable by Microsoft. Second, since the traffic showed up hours after the message was sent, it is not useful as a screening service. The link would have been clicked long before the URL was checked out. The only mitigating piece of this mess is that the request was a HEAD and not a GET, so they're not fetching the whole contents of the page. But the damage is done long before.

The ZDNet do not say that Microsoft aren't reading and interpreting what people write in private chat. ZDNet just say its "almost certainly innocent" because its done automatically by a machine for the purpose of increased security.

I for once disagree here that such actions are innocent. When peoples private conversation is read and interpreted, even by a machine, most people still get a feeling of lost security. This in turn causes a real problem from lower personal security, increased mental stress, and social self-imposed restrictions.

In addition to sp332's well-taken points, there is the fact that what Microsoft sees, it cannot prevent the USA government and its allies from seeing. Many Skype customers would see that as an unacceptable threat.

The article concludes: There’s no evidence that anyone, human or machine, is reading your confidential messages.

Well obviously, a machine is reading your confidential messages, if only to scan them for links. In the most benign case, the link scanning could be done in the skype client (closed source software on your machine), and MS's servers are seeing a list of links + an encrypted message.

But we just don't know, do we?

The best recommendation I have at the current time is OTR https://en.wikipedia.org/wiki/Off-the-Record_Messaging, authenticate your key fingerprints, ensure that neither party's chat program is logging, and that both computers are free of malware.

Pidgin supports OTR, but it crashes enough to raise concerns about that last point.

For privacy in asynchronous text communication email with GPG is still pretty much as bulletproof a solution as you can get.

For real-time text chat you can try Cryptocat: it's cross-pratform, implements the OTR protocol [1] and is rather user-friendly.

[1] https://en.wikipedia.org/wiki/Off-the-Record_Messaging

SSH into a secure common server and use talk(3) (http://en.wikipedia.org/wiki/Talk_(software)) ;-)

I've switched to Yate's QT client (http://yate.null.ro) for all my communication needs. allocate about 512MB of RAM to a VM for Asterisk/Openfire/FreePBX, and connect to it. You'll have voice/video plus instant messaging, with no central authority snooping on all your conversations.

I realize I could probably use Yate for everything, but I know asterisk and openfire better at this point, so I use them. :)

Hide your messages in Bitcoin?

http://www.fastcolabs.com/3007320/tracking/bitcoin-coming-br...

Google Hangout maybe?

IRC if you don't require audio and video.

Doesn't it totally undermine the message made on scroogled.com, Microsoft's anti-Google advertising campaign?

http://www.scroogled.com/mail

THINK GOOGLE RESPECTS YOUR PRIVACY? THINK AGAIN.

Google goes through every Gmail that's sent or received, looking for keywords so they can target Gmail users with paid ads. And there's no way to opt out of this invasion of your privacy. Outlook.com is different—we don't go through your email to sell ads.

I've recently discovered that MSN censors IMs with some urls. From reports, it seems that the censor rules are really random too: e.g. everything with the .io tld. It also gave zero feedback that it was doing this, other than "error sending message".

That is not acceptable. If you think there is a virus in a URL, attach a warning as web browsers do with domains that have had reports of distributing malware. And beyond that, actually make sure that you only do this for sites that are really a danger, rather than making up arbitrary rules with exceedingly low precision.

A few hours after the link is typed into the chat window?

I would prefer they put their efforts into making a secure operating system in the first place instead of trying to nanny their users in such a creepy fashion.