Security and privacy concerns of Skype

[TargeT]

Posted by Bill Ryan (here)
Folks, no communications are secure. And 256-bit encryption means nothing at all.
[/INDENT][/INDENT][/INDENT][/INDENT]

Encryption DOES work... (to slow them down anyway,, until quantum computing is real (or more wide spread if it is real))

How ever 256bit is not complex enough, you need to (at a minimum) go for 2,048bit or higher; I suggest 4,096 OR HIGHER.

Look to see what the highest level (256bit etc...) of encryption software that is being legally sold from the US to outside countries, that is the level that is easily crackable by the NSA/CIA (ortherwise it would be restricted from export) take that number and double it at a minimum and start there.

Posted by Anchor (here)
Yes - well - I still use skype and when I do I know its not private (but it is also on a VM and isolates my host machine and doesnt give it much to play with).

Sooner or later the NSA will backdoor VMWare (assuming that has not happened already...)



/waves at NSA/

Vmware is not safe on it's own, it's just another layer of protection

[Frank V]

Posted by Paul (here)

Posted by Aragorn (here)
Either way, if the thread is to be renamed -- which I fully support, because I wasn't even aware that the current thread title would come across as alarmist to anyone -- then I would suggest something along the lines of...

Why you should use another communications platform than Skype

... or...

Lots of reasons why you shouldn't use Skype

... or something of that flavor. It's pretty late here already and I'm afraid that both my eloquence [:cough cough:] and my contact lenses are starting to suffer under my fatigue, so if you find a way to more properly reword those thread title replacement suggestions, then by all means, be my guest. ;-)

OK - I took at stab at changing the title of this thread. I changed it

from

Attention Skype users -- important security and privacy concerns!

to

Security and privacy concerns of Skype

Let me know if that doesn't seem right to you, or if you would like to suggest something else.

Thanks.

I think you've made an excellent choice, Paul. I am very satisfied with this new thread title. :-)

[Frank V]

Posted by Billy (here)
The team are very aware that Skype and most other forms of communications are not always secure. At times we actually say hello and leave a message to those who are monitoring our conversations. We have at times typed in key words that would attract their attention, then leave them guidelines on how to change for the betterment of all humanity.

Sometimes it is good to explain to a bastard who believes they have power, or the pawns that they use, That their game is failing and it is time not to be a bastard anymore.

That is an awesome attitude, Billy, and I myself have also been doing that very same thing on occasion when (in the past) using a chat applet on my Android smartphone. :-)

Namaste. :-)

[Anchor]

Posted by TargeT (here)
How ever 256bit is not complex enough, you need to (at a minimum) go for 2,048bit or higher; I suggest 4,096 OR HIGHER.

I think you could be getting your asymmetric key sizing requirements mixed up with your symmetric key sizes. They are not the same. Asymmetric needs to be 2048 or higher, Symmetric (usually) 256bit or higher.

Posted by TargeT (here)
Vmware is not safe on it's own, it's just another layer of protection

Agree but it is a pretty good layer. I cam make nice little strong boxes to keep my nasties in.

[ThePythonicCow]

Posted by TargeT (here)
How ever 256bit is not complex enough, you need to (at a minimum) go for 2,048bit or higher; I suggest 4,096 OR HIGHER.

For asymmetric public-private key encryption, yes, one should be using such long keys for optimum security, because such asymmetric encryption is relying on the difficulty of factoring the products of two large prime numbers, so essentially, the level of difficulty of brute forcing a public-private key encrypted message is proportional to the square root of the key length.

A message encrypted with a 4096 length asymmetric public-private key is about as difficult to brute force decrypt as a message encrypted with a 64 (the square root of 4096) bit symmetric key (give or take some wild waving of hands and a few handfuls of bits.)

===

The essential advantage of asymmetric public-private key encryption is that it does not require exchanging secret information in order communicate. I can (and do, here) advertise to the world the public key that can be used to encrypt messages sent to me, for which only I have the corresponding private key, so only I can decrypt them.

The essential disadvantages of asymmetric public-private key encryption are that:

• they are harder for non-crypto-geeks to understand, and
• they are harder for computers to encrypt/decrypt.

One common use of asymmetric public-private key encryption is to handle the initial, secret, exchange of a randomly selected symmetric key, which can then be used to continue the interaction, using much easier to compute symmetric encryption

===

P.S. -- I see Anchor already posted as much, more succinctly, above.