Re: [cryptography] skype backdoor confirmation
I was inspecting Skype terms and condition http://www.skype.com/en/legal/tou/#15 [...]We will process your personal information, the traffic data and the content of your communication(s) in accordance with our Privacy Policy:http://www.skype.com/go/privacy.; http://www.skype.com/en/legal/privacy/ 1. WHAT INFORMATION DOES SKYPE COLLECT AND USE? . Content of instant messaging communications, voicemails, and video messages Nikos On Sun, May 19, 2013 at 10:41 PM, Jacob Appelbaum ja...@appelbaum.net wrote: Krassimir Tzvetanov: To the best of my knowledge in Russia (no, I'm not Russian nor have lived there so I'm not 100% sure) you need to submit a copy of the private key if you are operating a website providing encryption on their territory to allow for legal intercept. They also have other provisions about wiretapping and monitoring which would mean that Skype really has not options if they want to _legally_ operate there... It's just the way the local legislation is rather than a function of how Skype is. They are just following the law. Now if somebody does not like the law there are other ways to approach this but breaking/violating it is usually one that is not effective. I think this discussion is focusing too much into the technical details and forgets a simple detail - doing some of those things to increase privacy may itself be _illegal_ in certain jurisdictions which make this even more fun. It's not impossible but it is usually very difficult to provide technical solutions to political/politics problems. That's of course just my experience :) Cheers, Krassimir Hi, I'm late to the party on this list but I've been worried about these kinds of backdoors in Skype for quite some time. My worry partially comes from the common rumors, of which there are many, though it is largely the existential proof, the economic, the political and the social contextual issues that raise the largest concerns in my mind. As we've seen with Cisco, we know how some of these so-called lawful interception systems are implemented: http://www.cisco.com/web/about/security/intelligence/LI-3GPP.html This patent by Microsoft may be of interest to those looking into Skype, automated interception and probably many other kinds of interception - note that this is not just a matter of recording, it in fact *tampers* with the data: Aspects of the subject matter described herein relate to silently recording communications. In aspects, data associated with a request to establish a communication is modified to cause the communication to be established via a path that includes a recording agent. Modification may include, for example, adding, changing, and/or deleting data within the data. The data as modified is then passed to a protocol entity that uses the data to establish a communication session. Because of the way in which the data has been modified, the protocol entity selects a path that includes the recording agent. The recording agent is then able to silently record the communication. http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2Sect2=HITOFFu=%2Fnetahtml%2FPTO%2Fsearch-adv.htmlr=1f=Gl=50d=PG01p=1S1=20110153809OS=20110153809RS=20110153809 Note that this is from 2009 and the Skype purchase was not finalized until 2011. Perhaps the authors (Ghanem; George; (Redmond, WA) ; Bizga; Lawrence Felix; (Monroe, WA) ; Khanchandani; Niraj K.; (Redmond, WA)) of that patent are open to discussing how they might improve on their patent for a peer to peer system as deployed today? :) Skype is clearly inspecting the entire message and right now, we have an existential proof that they extract at least HTTP and HTTPS urls and process them in some fashion. I suspect that it would be a useful idea to insert many different kinds of protocols to see the depth of the rabbit hole probing, so to speak. http://user@password:www.example.com/secret-area magnet://[hash] ftp://ftp.example.com https://user@password:www.example.com/secret-area telnet//user@password:telnet.example.com I would also suggest that we might try a few hacks to determine where the parsing, inspection and extraction of interesting data is or isn't taking place. As an example - run Skype in a virtual machine, type a message - delay the message sending to the network, freeze the virtual machine and flip a single bit in the url already in the outbound message queue. This isn't trivial to do with Skype by any means but it most certainly isn't impossible for someone with the inclination. We know that Skype clients sync up the social graph of a given user; they call this a buddy list. This suggests that information in the directory of clients and the linked list for relationships is stored on their servers - is it encrypted in a way that may not be recovered by anyone other than the user? Skype dynamically routes calls to devices, does this imply that the location of the user is
Re: [cryptography] skype backdoor confirmation
i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. the bad guy will always have a relationship through the buddy list, which is exactly why they are using taken over accounts. the situation you are imagining is the way it was prior to the rash of account takeovers, and they way it might be if accounts could not be taken over easily (e.g. if they used 2 factor or some other way of knowing the customer was authentic). On May 18, 2013, at 6:04 PM, Jeffrey Walton noloa...@gmail.com wrote: On Sat, May 18, 2013 at 5:38 PM, mark seiden m...@seiden.com wrote: except bad guys will always opt of having their content inspected. Right, that's why it becomes the receiver's option for unknown senders. If there's an existing relationship between the sender and receiver, I imagine the rates of malicious URLs and other content drop dramatically. In this case, the service should stop aggregating data at the user's choice. That's if they had a choice. Jeff On May 18, 2013, at 10:46 AM, Jeffrey Walton noloa...@gmail.com wrote: On Sat, May 18, 2013 at 1:24 PM, mark seiden m...@seiden.com wrote: ... there are numerous other IM systems that are server centric and do a lot of work to look for and filter bad urls sent in the message stream. this is intended to be for the benefit of the users in filtering spam, phishing, malware links, particularly those that spread virally through buddy lists of taken over accounts. sometimes these links (when believed to be malicious) are simply (and silently) not forwarded to the receiving user. this involves databases of link and site reputation, testing of new links, velocity and acceleration measurements, etc.the usual spam filtering technology. my impression is that almost all users thank us for doing that job of keeping them safe. they understand that IM is yet another channel for transmitting spam. the url filtering is aggressive enough (and unreliable enough) in some cases that you have to check with your counterparty in conversation if they got that link you just sent. so users are aware of it, if only as an annoyance. (once again, spam filtering gets in the way of productive communication) i am merely telling you how it is. obviously user expectations differ on AIM, Yahoo Messenger, etc. from those of users on Skype, some of whom believe there is magic fairy dust sprinkled on it, and that it is easier to use than something else with OTR as a plugin. Perhaps the user should be given a choice. The security dialog could have three mutually exclusive choices: * Scan IM messages for dangerous content from everyone. This means company will read (and possibly retain) all of your messages to determine if some (or all) of the message is dangerous. * Scan IM messages for dangerous content from people you don't know. This means company will read (and possibly retain) some of your messages to determine if some (or all) of the message is dangerous. * Don't scan IM messages for dangerous content . This means only you and the sender will read your messages. Give an choice, it seems like selection two is a good balance. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
Mark Seiden: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. the bad guy will always have a relationship through the buddy list, which is exactly why they are using taken over accounts. the situation you are imagining is the way it was prior to the rash of account takeovers, and they way it might be if accounts could not be taken over easily (e.g. if they used 2 factor or some other way of knowing the customer was authentic). Indeed. It also depends entirely on the end user software. Often it is possible that there are two users with the same name but with different identifiers. This also doesn't stop people from registering domains that look-alike, I might add. We already see this kind of behavior with phishing and we have continued to see it for the better part of a decade. There are obviously smart heuristics for ways to flag a message - however, if I was pwning such a system, I would just own the content inspection system at a different level - say, by fingerprinting the first request and not returning malware. Only when the user, who is easy to distinguish from Microsoft, visits the site will they get the actual targeted malware. This is also what we see with web pages that provide browser specific exploits on a per user basis. The other reason to get the buddy list is that the social graph is almost as important as the content, if not more important for some groups. All the best, Jacob ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On 19/05/13 00:29 AM, Ethan Heilman wrote: Actually I think that was the point, as far as anyone knew and from the last published semi-independent review (some years ago on the crypto list as I recall) it indeed was end2end secure. Skype has never claimed it is end to end secure ... I think that is false. Skype have in the past facilitated (contracted?) at least one independent audit of the system that is still posted on their website. As an audit, it provides a point-in-time statement that we can rely upon to a great extent, as both representations of the special auditor and of Skype. This was also circumstantially confirmed in around 2007 when it was discovered that intelligence agencies were sharing attack kits, as you suggest [0]. This raises then several questions - for me at least. (1) when did Skype change, (2) what actions did they take to change the public perception of their offering, (3) how far have they unwound it? (1) when? It has long been suggested that Microsoft did this. But they have been coy about it, they have admitted to some form of legal provision, but they certainly haven't announced the wholesale dropping of the e2e security as suggested by URL scanning. (2) deception. People are entitled to rely on the representations made by other people, especially when they are made on the basis of some product offering for security. Skype made their reputation as being free and secure (e2e) telephony. The latter was something that many people bought into. It is now the largest telco in the world, by minutes, in no small part because people enjoyed both security as well as free calls to their friends. If however they have changed that security claim, and declined to inform users, then that is a deception. Worse, it is a deception against their users, for the benefit of others (in this case intel police) that are not their users. If indeed they have done this, then people like us -- the security community -- are entitled to report the deception widely. But, we cannot report that deception until we get proof. Hearsay doesn't cut the mustard [1]. Now we have proof. (3) How far does this go? The URL scanning indicates that there is far more going on than some special supernode mode to decrypt on demand by court orders [2]. This indicates a complete roll-back from e2e to client-server security. Which brings with it data mining, live feeds to intel and police and Microsoft support and the Egg Board, marketing sales, vulnerability to corruption bribery, and routine use in civil court cases such as divorce [3]. This is not the reputation that Skype was made on. I would wonder whether there is anything left of it? iang [0] police agencies were also having trouble and complaining at that time in the press and to lawmakers; see last quote below. [1] at least, in anglo countries, society's convention is that one sticks to the facts. In Germany and perhaps others, proof of facts is not necessarily a defence against defamation of a company. From what I recall, we'd probably need some locals to explain it more. [2] 1st and 2nd quotes below. [3] E.g., as John reported, a clear case of non-intelligence low-bar availability for a routine prosecution of some random journeyman level scumbags. John, if you're still suffering our questions, was your case civil or criminal? in fact they have hinted many times that they can and do listen to users conversations: Skype, Skype's local partner, or the operator or company facilitating your communication may provide personal data, communications content and/or traffic data to an appropriate judicial, law enforcement or government authority lawfully requesting such information. Skype will provide reasonable assistance and information to fulfill this request and you hereby consent to such disclosure. - http://www.skype.com/en/legal/privacy/#collectedInformation After Microsoft in May 2011 acquired Skype, she provided legal technology of Skype audition, says the executive director of Peak Systems Maxim Emm . Now, any subscriber can switch to a special mode in which the encryption keys that were previously generated on the phone or computer, the subscriber will be generated on the server. [..] With access to the server, you can listen to the conversation or read the correspondence. Microsoft provides the opportunity to use this technology, intelligence agencies around the world, including Russia, the expert explains. google translated from Russian http://www.vedomosti.ru/politics/news/10030771/skype_proslushivayut Skype spokesman did not deny the company's ability to intercept the communication. On the question of whether Skype could listen in on their users' communication, Kurt Sauer, head of the security division of Skype, replied evasively: We provide a secure means of communication. I will not say if we are listening in or not. -
Re: [cryptography] skype backdoor confirmation
[3] E.g., as John reported, a clear case of non-intelligence low-bar availability for a routine prosecution of some random journeyman level scumbags. John, if you're still suffering our questions, was your case civil or criminal? Criminal, US vs. Christopher Rad. http://www.justice.gov/usao/nj/Press/files/Rad,%20Christopher%20Verdict%20PR.html ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Fri, May 17, 2013 at 6:06 AM, Ben Laurie b...@links.org wrote: On 17 May 2013 11:39, d...@geer.org wrote: Trust but verify is dead. Maybe for s/w, but not everything: http://www.links.org/files/CertificateTransparencyVersion2.1a.pdf Which requires s/w. Infinite loop detected. :) More seriously, we can't detect all backdoors before using the software, but at least we can fix the ones we find if we have suitably-licensed source. Nico -- ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On 20 May 2013 17:35, Nico Williams n...@cryptonector.com wrote: On Fri, May 17, 2013 at 6:06 AM, Ben Laurie b...@links.org wrote: On 17 May 2013 11:39, d...@geer.org wrote: Trust but verify is dead. Maybe for s/w, but not everything: http://www.links.org/files/CertificateTransparencyVersion2.1a.pdf Which requires s/w. Infinite loop detected. :) More seriously, we can't detect all backdoors before using the software, but at least we can fix the ones we find if we have suitably-licensed source. As I've mentioned before, you can use the transparency concept to at least verify that the s/w you are running is the same s/w as others are running (and hence have had a chance to verify). ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
(i know that at least jake and ian understand all the nuances here, probably better than me.) bus still, i would like you to consider, for a moment, this question: suppose there were a service that intentionally wanted to protect recipients of communications from malicious traffic? when i was at $big_provider, i spent an awful lot of time and energy communicating with colleagues and sharing threat intelligence about bad guys. i.e. accumulating reputation information about the counterparties. any mechanism to do this (that i could think of, anyway) presents a possible risk to those communicants who want no attributable state saved about their communication. either these are privacy freaks (not intended pejoratively: for whatever reason, they're entitled to be…) … or criminals. it's really hard to engineer systems that will satisfy the needs of privacy freaks while still protecting the naive, and not at the same time equip criminal enterprises. most of us seem to be willing to engineer to trust ourselves (the operators of the facility) to have good taste in protecting all but the criminals. only a few of us are willing to go as far as you can trust us because you don't have to. i still believe microsoft is trying to do the right thing here for 99*% of their users, but they can't help but get slammed because they haven't been crystal clear about it, hiding the activity with weasel words and legalese in their TOS. i also agree that relying on an old and inapplicable security review would be a deceptive practice. i agree with ian that telling people what your system does so they can manage their own risks (transparency) is a good middle ground. (but it also enables criminals to know how to avoid detection, not a society good). (so now we all know, skype is not suitable for privacy freaks or criminals! woo hoo.) (btw, keep in mind that any hosting provider can inspect hosted web content on their backends, which would show nothing in web access logs. their TOS doubtless permits that. there is nothing that i know of that requires your hosted content or your site activity to not be looked at by your provider, unless stored communication is involved, and even then there are provider exceptions such as for malware and AV scanning.) a few other comments interlineated. On May 20, 2013, at 7:55 AM, Jacob Appelbaum ja...@appelbaum.net wrote: Mark Seiden: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. the bad guy will always have a relationship through the buddy list, which is exactly why they are using taken over accounts. the situation you are imagining is the way it was prior to the rash of account takeovers, and they way it might be if accounts could not be taken over easily (e.g. if they used 2 factor or some other way of knowing the customer was authentic). Indeed. It also depends entirely on the end user software. Often it is possible that there are two users with the same name but with different identifiers. This also doesn't stop people from registering domains that look-alike, I might add. We already see this kind of behavior with phishing and we have continued to see it for the better part of a decade. yes, but good guys and brand protection companies routinely look for lookalike domains and phishing activity, both passively (zillions of honeypot mailboxes) and actively (looking at dns activity). There are obviously smart heuristics for ways to flag a message - however, if I was pwning such a system, I would just own the content inspection system at a different level - say, by fingerprinting the first request and not returning malware. Only when the user, who is easy to distinguish from Microsoft, visits the site will they get the actual targeted malware. This is also what we see with web pages that provide browser specific exploits on a per user basis. right. because one needs the right credentials to see the malicious payload, microsoft is supplying the complete URLS. makes sense to me. yup. the earliest hits on a brand new malicious web site, before a spam campaign is deployed, are likely to be AV/security companies, their hosting facility, and some crawlers trying to discover new content, but also the bad guys testing their content prior to deployment. the more stupid criminals deliver payloads in such circumstances (because they don't have to be smart to succeed). the smarter criminals filter based on ip address, initially. you have the wrong address, you get a 404. sometimes they're too smart for their own good, and whitelist their own cc addresses, oops. by shutting sites down at the earliest point, we only train the criminals to know how we must have found them, and become smarter. we have already trained the bad guys to lovingly age their sites (10 months in french
Re: [cryptography] skype backdoor confirmation
On Mon, May 20, 2013 at 12:08 PM, Mark Seiden m...@seiden.com wrote: any mechanism to do this (that i could think of, anyway) presents a possible risk to those communicants who want no attributable state saved about their communication. either these are privacy freaks (not intended pejoratively: for whatever reason, they're entitled to be…) … or criminals. Corporations are privacy freaks. I've worked or consulted for a number of corporations that were/are extremely concerned about data exfiltration. I'd not advise such corporations to use Skype without an agreement with Skype as to what can/does happen to the their data, or else to be very careful about what is exchanged over Skype. And it does happen that sometimes a corporation's employees need to communicate with people over Skype or similar *external* systems. Beyond corporations, individuals absolutely have a right to private communications with their lawyers, etc... And there need not be any criminal or civil liability for an individual to hide. For example, if I were trying to patent something, I'd want my communications with my lawyer kept secret. Nico -- ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Sat, May 18, 2013 at 3:15 PM, Adam Back a...@cypherspace.org wrote: Actually I think that was the point, as far as anyone knew and from the last published semi-independent review (some years ago on the crypto list as I recall) it indeed was end2end secure. Many IM systems are not end2end so for skype to benefit from the impression that they still are end2end secure while actually not being is the focus of this thread. The original Skype homepage (circa 2003/2004) claims the service is secure: Skype calls have excellent sound quality and are highly secure with end-to-end encryption. (http://web.archive.org/web/20040701004241/http://skype.com/). The new web page does not even use the word (web.archive.org/web/20130426221613/http://www.skype.com/). (Sorry to rewind so far back in the thread). Jeff ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Mon, May 20, 2013 at 12:22 PM, Jeffrey Walton noloa...@gmail.com wrote: The original Skype homepage (circa 2003/2004) claims the service is secure: Skype calls have excellent sound quality and are highly secure with end-to-end encryption. (http://web.archive.org/web/20040701004241/http://skype.com/). Secure in what way though? Probably: relative to passive eavesdroppers. As for LEA, forget it. (Nothing is secure w.r.t. LEA that have jurisdiction, as ultimately there's the rubber hose.) The new web page does not even use the word (web.archive.org/web/20130426221613/http://www.skype.com/). So their advertising/terms changed. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Mon, May 20, 2013 at 1:30 PM, Nico Williams n...@cryptonector.com wrote: On Mon, May 20, 2013 at 12:22 PM, Jeffrey Walton noloa...@gmail.com wrote: The original Skype homepage (circa 2003/2004) claims the service is secure: Skype calls have excellent sound quality and are highly secure with end-to-end encryption. (http://web.archive.org/web/20040701004241/http://skype.com/). Secure in what way though? Probably: relative to passive eavesdroppers. As for LEA, forget it. (Nothing is secure w.r.t. LEA that have jurisdiction, as ultimately there's the rubber hose.) Well, I take 'secure' to mean confidentiality and authenticity, including an authenticated key agreement. If we don't know who we are talking to, or someone else can listen in, or someone else can tamper, then its surely not secure by any reasonable definition. For a typical user, they would probably take 'secure' to mean that only both users (the endpoints) can read the message, hear, the conversation, see the video, etc. I'm not sure how they would react to 'highly secure', other than its 'secure' plus some other good stuff they can't even imagine. The new web page does not even use the word (web.archive.org/web/20130426221613/http://www.skype.com/). So their advertising/terms changed. It appears so. In the US, I believe that's a Material Adverse Change and usually requires explicit notification (credit card issuers were especially bad about changing terms). Do any Skype users recall being informed the terms changed dramatically? There was a time the FTC would do something about it. In the end, does it matter since it appears there are only carrots and no sticks? Jeff ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
James A. Donald: On 2013-05-20 7:49 PM, Mark Seiden wrote: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. Zombie computers are seldom of high value. Some malware is designed to keep people communicating, under heavy watch; it is not always designed to abuse a system the traditional manner befitting script kiddie botnets. What steps do you normally take to mitigate Skype exploitation that leverages 0day and then dumps say, FinFisher on your system? That is - how would they notice and if they were being logged, how would *you* notice on your end? All the best, Jacob ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Tue, May 21, 2013 at 10:46:55AM +1000, James A. Donald wrote: On 2013-05-20 7:49 PM, Mark Seiden wrote: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. Zombie computers are seldom of high value. The people selling botnets would beg to differ I think. -- staticsafe O ascii ribbon campaign - stop html mail - www.asciiribbon.org Please don't top post - http://goo.gl/YrmAb Don't CC me! I'm subscribed to whatever list I just posted on. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On Mon, May 20, 2013 at 8:55 PM, Jacob Appelbaum ja...@appelbaum.net wrote: James A. Donald: ... Zombie computers are seldom of high value. Some malware is designed to keep people communicating, under heavy watch; it is not always designed to abuse a system the traditional manner befitting script kiddie botnets. In Skype's case, it appears there is no need for the malware to coerce communications since the service is always on (http://www.sec.gov/Archives/edgar/data/1498209/000119312510182561/ds1.htm): The number of connected users is subject to uncertainties and in some ways may overstate the number of users actively using our products during a given period. For example, for a number of our users, once a user has downloaded our software onto their device, the software will automatically be logged in to when the device is turned on, even if the customer takes no steps to affirmatively engage our software client after initial registration. Jeff ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged, how would *you* notice on your end? I would notice, because they would spam me, this being the primary income source and reproductive method for botnets. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
James A. Donald: James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged, how would *you* notice on your end? I would notice, because they would spam me, this being the primary income source and reproductive method for botnets. You're not distinguishing between the classes of attacker that exist here; they are not all the same. Police malware only spreads, for example, when it needs coverage. It makes sense for such activity to target friends of a target when the target's computer is harder to compromise. Also, the bugs/exploits I've heard/seen/read about about in Skype do not all have UX indications that you've even received a message. All the best, Jacob ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On 2013-05-21 3:08 AM, Mark Seiden wrote: (i know that at least jake and ian understand all the nuances here, probably better than me.) bus still, i would like you to consider, for a moment, this question: suppose there were a service that intentionally wanted to protect recipients of communications from malicious traffic? when i was at $big_provider, i spent an awful lot of time and energy communicating with colleagues and sharing threat intelligence about bad guys. Gmail is very efficient at filtering out malicious traffic. It also spies on all its customers and keeps all their mail in the clear forever. For this reason I use mail services that perform absolutely no filtering, and do my own filtering. If I get filtered, I want to know it. Furtive filtering is a hostile act. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On 2013-05-21 4:50 AM, Mark Seiden wrote: you can advise whatever you fancy, but skype, google, microsoft are unlikely to agree to any such thing unless your client is a Really Big company who pays them a lot of money. and why should they even bother their lawyers? pretty much, their service Is What it Is, take it or leave it. If, however, they don't tell you what their service is ...? If, out of the kindness of their hearts, they decide to check out all your urls /without telling you/. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
Gmail only keeps in the clear what you leave in the clear. s/a hostile act/less useful to power users than filter but notify On Mon, May 20, 2013 at 8:48 PM, James A. Donald jam...@echeque.com wrote: On 2013-05-21 3:08 AM, Mark Seiden wrote: (i know that at least jake and ian understand all the nuances here, probably better than me.) bus still, i would like you to consider, for a moment, this question: suppose there were a service that intentionally wanted to protect recipients of communications from malicious traffic? when i was at $big_provider, i spent an awful lot of time and energy communicating with colleagues and sharing threat intelligence about bad guys. Gmail is very efficient at filtering out malicious traffic. It also spies on all its customers and keeps all their mail in the clear forever. For this reason I use mail services that perform absolutely no filtering, and do my own filtering. If I get filtered, I want to know it. Furtive filtering is a hostile act. __**_ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/**mailman/listinfo/cryptographyhttp://lists.randombit.net/mailman/listinfo/cryptography -- Kyle Creyts Information Assurance Professional BSidesDetroit Organizer ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
Re: [cryptography] skype backdoor confirmation
On 2013-05-21 12:41 PM, Jacob Appelbaum wrote: James A. Donald: James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged, how would *you* notice on your end? I would notice, because they would spam me, this being the primary income source and reproductive method for botnets. You're not distinguishing between the classes of attacker that exist here; they are not all the same. Police malware only spreads, for example, when it needs coverage. Police install malware by black bagging, and by the same methods as botnets. Both methods are noticeable. ___ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography
