Hacker News Reader

Comment by RyanZAG | Hacker News Reader

I thought this story had been cleared up awhile ago?

Skype used to use an ecrypted, peer-to-peer protocol that made it very difficult for Skype communications to be wiretapped, causing difficulties for the NSA etc.

As per http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_... and similar coverage years ago, Microsoft then bought out Skype even though it was clear it was non-profitable. The peer-to-peer Skype system was dropped shortly after, and all Skype communications were centralized through Microsoft servers.

Following releases by Snowden, it is now clear that Microsoft is wiretapping all Skype communications at the request of the NSA.

View on HN

Alright, first of all let's remember that the NSA added Skype to the PRISM program before Microsoft even bought it.

Secondly, there were very real technical reasons why Microsoft rearchitected the Skype backend. They needed to do this in order to make Skype compatible with new generation of devices. This has been posted on HN before: https://news.ycombinator.com/item?id=5930600

I'm not disputing that the changes allow for easier eavesdropping (I honestly don't know enough technical details to have an opinion either way). However, I do think that it's rather meaningless since Skype was already in the PRISM program prior to the changes, and that the people behind the architectural changes probably had absolutely no idea about the PRISM program in the first place and were simply doing it in order to make Skype a better product on mobile devices.

> Secondly

That was a load of bullshit made-up excuses back then and it still is now. Call traffic does not need to go through Microsoft servers. Making it go P2P even in the presence of NAT/firewalls at both ends is a problem solved several years ago. You have to make a conscious decision not to support that and the reason will not be a technical one.

> You have to make a conscious decision not to support that

To emphasize - Skype had that solved years ago, to the point that e.g. back in the day in my university, they announced at some point that Skype is banned (because it was a bandwidth hog - the uni had a bad connection) but they were unable to enforce that at the firewall because their firewall couldn't tell if it was a skype connection or not.

Skype was built by the people who previously made Kazaa, the most efficient P2P app at the time. There was VOIP software before Skype, but non worked as well -- and it wasn't the Skype voice codec that made it work well (although SILK when introduced later did wonders for quality, and SVOPC was not bad) - it was the P2P architecture that provided excellent connectivity, that other VOIP apps at the time did not have.

Furthermore, Google did not purchase Skype BECAUSE it was P2P/distributed, which goes against the spirit of every Google service.

The peer-to-peer Skype system was dropped shortly after, and all Skype communications were centralized through Microsoft servers.

People keep repeating this, but I've seen no evidence that it means what people think it means. The location of supernodes has no bearing on encryption or whether call data goes through supernodes.

But it pretty much guarantees that all the data doesn't flow through one super-node. P2P design makes a lot of sense. Centralized didn't, until the recent events.

It actually didn't make sense (P2P) after a certain point. There was a huge Skype outages because of a SuperNode back in 2010 when it was P2P. The problem was a lot of super nodes ended up being desktop hardware that simply couldn't handle the increased load, likewise, since most desktops are behind some form of NAT or firewall, not many clients are eligible to be supernodes, meaning fewer and fewer reliable hosts to act as supernodes. Not to mention the additional load it creates for the user of the machine when it becomes a supernode.

The solution was simply for Skype to host its own super nodes. That was the original reason.

Of course, now there is also the wiretapping concern, but I think its high time something replaced Skype anyway, that either doesn't require the supernode weakness and possibly open source so the encryption can be ensured sending your private cert/key over to the centralized node/servers.

http://saikat.guha.cc/pub/iptps06-skype/

http://skype-open-source.blogspot.ch/2012/05/microsoft-wiret...

Complicating the "Microsoft corrupted the virtuous Skype" story is the fact that Skype appears in the PRISM slides dating to before Microsoft's purchase of it.

Simply not true.

Skype appeared in the PRISM program on 2/6/11. Microsoft bought Skype on 10 May 2011. Very fishy dates? You bet.

https://en.wikipedia.org/wiki/Skype#Microsoft_acquisition

http://en.wikipedia.org/wiki/File:Prism_slide_5.jpg

Your first link indicates the acquisition wasn't completed until October 2011.

Can you expand on why that part matters?

I thought it made the dates look even less "fishy".

It's a flawed thought, since it's only the date they complete the acquisition on paper i.e. to signal to everyone that it's permanent. This does not forbid you from working with the company for integration purposes, or why would you have such a long time span between announcing you agreed to buy somebody and actually 'doing it'?

In reality you would do a lot of work with the company you're attempting to buy. If for example Skype promised they could change the network to enable wiretapping yet they are unable to, then MSFT could cancel the deal. Or indeed for any of the reasons outlined in the original press release about 'forward-looking statements'.

In US style dates, 2/6/11 (February 6th, when Skype appears on Prism slide) comes before May 10th (when Skype was purchased by MSFT).

If that isn't the source of confusion, I don't understand your point.

Who was the owner of Skype before Microsoft? I think those parties are more connected than meets the eye.

Yep, as an early user of skype (back when it was still a european company) I clearly remember when it was labeled as "wiretap proof"

You should read the article first (hint: it's not about why Microsoft moved off P2P). You can do secure communications even without P2P, and the point of the article was that Microsoft may have very little reason not to do that, and that they should, because in terms of private/secure communications Skype went from one of the best to one of the worst right now.

Reply on news.ycombinator.com