Hacker News Reader

Comment by nallerooth | Hacker News Reader

You might be interested in this article. http://www.h-online.com/security/news/item/Skype-with-care-M... (Microsoft visiting all HTTPS-links sent over skype). They do, however, still tell you that the connection is end-to-end encrypted http://download.skype.com/share/security/2005-031%20security... (See section 1.2, Security Policy). Now, if they can read all your links using https, they can read anything else too.

Edited: Spelling

View on HN

Just pondering wordplays: Assume I implement a messenger, and I want to obtain full access to messages, but I also want to be able to put "end-to-end encrypted" on my product.

Couldn't I go ahead and encrypt everything with an encryption system where I know all the keys? It end-to-end encrypted, since your client encrypts and my client decryptys and hey, it might even be some good asymmetric encryption, but nothing matters as long as I don't disclose my key management or, even better, put all key management into your hands.

And even worse, if I don't give my transmission servers access to these keys, "no intermediate node" has access to this information, because only secondary nodes have access to the information.

It's a scary twist of words, but I dunno... I could probably convince a lot of standard users with such smoke and mirrors.

I completely agree. For a couple of years, I've been living by the rule "If it's supposed to be secret, don't put it anywhere near the Internet". The problem is that a lot of people trust statements like "unbreakable encryption" and "your password cannot be recovered, by any means".

My biggest issue, in a way, is the stupidity of claiming to have end-to-end encryption and then visit https-URIs sent via Skype.

Reply on news.ycombinator.com