Even comments here indicate people clearly didn't read this email or fail to understand it at all.
Like I said, people still don't get it.
Supernodes are a directory service. "Traffic" as in text and video traffic rarely, if ever, is transmitted through Supernodes.
I am unaware of a way to ensure privacy but still have a third party have the ability to read your messages. However, I'm open to ideas.
The location of the "supernodes" (on client machines, or in a datacenter) is separate from whether encrypted traffic can be read by a third party. Using a totally decentralized system makes it a little harder to eavesdrop, but it's entirely possible to develop a completely secure system in the centralized model.
That said, I've never been terribly impressed with Skype's security model. Even before Microsoft bought them. It might have been decentralized, and the traffic might be encrypted, but the encryption lacks a strong trust model. There's never been any way to make sure that your connection hasn't been MITM'ed, since the system doesn't provide any way to verify the identity (key fingerprint) of the person you're talking to.
The current encryption is fine if you're worried about rogue network administrators, but has never been sufficient if you're worried about being targeted by state actors.
For Skype's security model, I thought that before MS bought them they had E2E encryption (sure, it can be MITM'ed, but the conversation's that's not MITM'ed cannot be decoded easily, whereas they could be now).
(Is it fair to say that I verify _some_, not all, of my friends' identity via the way the talk? I feel like if I have E2E encryption, I would be fine as a MITM would have a pretty difficult time faking how some of my friends talk.)
E2E encryption is only as secure as the key exchange, so if the central Skype server gives you and your friend the keys you need to encrypt/decrypt then just passes along your E2E-encrypted packets... anyone who was able to snag the keys and has access to the encrypted packets can decrypt everything just as you can.
Is there any evidence that they removed E2E crypto for voice calls? People keep saying this but their reason seems to be "because MS".
You and I have a secure P2P connection (aka Skype). But my client and your client check hashes of URLs against a third party service before transmitting the message to the other person.
There, you can blacklist URLs and it doesn't send any message contents to anyone (only hashes of ONLY urls) and then sends the actual full message, encrypted on the wire.
It's not hard to conceive how this system would work.