Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Nikos Fotiou
I was inspecting Skype terms and condition http://www.skype.com/en/legal/tou/#15 [...]We will process your personal information, the traffic data and the content of your communication(s) in accordance with our Privacy Policy:http://www.skype.com/go/privacy.;

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Mark Seiden
i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. the bad guy will always have a relationship through the buddy list, which is exactly why they are using taken over accounts. the

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jacob Appelbaum
Mark Seiden: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. the bad guy will always have a relationship through the buddy list, which is exactly why they are using taken over

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread ianG
On 19/05/13 00:29 AM, Ethan Heilman wrote: Actually I think that was the point, as far as anyone knew and from the last published semi-independent review (some years ago on the crypto list as I recall) it indeed was end2end secure. Skype has never claimed it is end to end secure ... I

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread John Levine
[3] E.g., as John reported, a clear case of non-intelligence low-bar availability for a routine prosecution of some random journeyman level scumbags. John, if you're still suffering our questions, was your case civil or criminal? Criminal, US vs. Christopher Rad.

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Nico Williams
On Fri, May 17, 2013 at 6:06 AM, Ben Laurie b...@links.org wrote: On 17 May 2013 11:39, d...@geer.org wrote: Trust but verify is dead. Maybe for s/w, but not everything: http://www.links.org/files/CertificateTransparencyVersion2.1a.pdf Which requires s/w. Infinite loop detected. :) More

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Ben Laurie
On 20 May 2013 17:35, Nico Williams n...@cryptonector.com wrote: On Fri, May 17, 2013 at 6:06 AM, Ben Laurie b...@links.org wrote: On 17 May 2013 11:39, d...@geer.org wrote: Trust but verify is dead. Maybe for s/w, but not everything:

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Mark Seiden
(i know that at least jake and ian understand all the nuances here, probably better than me.) bus still, i would like you to consider, for a moment, this question: suppose there were a service that intentionally wanted to protect recipients of communications from malicious traffic? when i

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Nico Williams
On Mon, May 20, 2013 at 12:08 PM, Mark Seiden m...@seiden.com wrote: any mechanism to do this (that i could think of, anyway) presents a possible risk to those communicants who want no attributable state saved about their communication. either these are privacy freaks (not intended

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jeffrey Walton
On Sat, May 18, 2013 at 3:15 PM, Adam Back a...@cypherspace.org wrote: Actually I think that was the point, as far as anyone knew and from the last published semi-independent review (some years ago on the crypto list as I recall) it indeed was end2end secure. Many IM systems are not end2end so

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Nico Williams
On Mon, May 20, 2013 at 12:22 PM, Jeffrey Walton noloa...@gmail.com wrote: The original Skype homepage (circa 2003/2004) claims the service is secure: Skype calls have excellent sound quality and are highly secure with end-to-end encryption.

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jeffrey Walton
On Mon, May 20, 2013 at 1:30 PM, Nico Williams n...@cryptonector.com wrote: On Mon, May 20, 2013 at 12:22 PM, Jeffrey Walton noloa...@gmail.com wrote: The original Skype homepage (circa 2003/2004) claims the service is secure: Skype calls have excellent sound quality and are highly secure with

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jacob Appelbaum
James A. Donald: On 2013-05-20 7:49 PM, Mark Seiden wrote: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. No one on my buddy list has been taken over, or if they have, they took

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread staticsafe
On Tue, May 21, 2013 at 10:46:55AM +1000, James A. Donald wrote: On 2013-05-20 7:49 PM, Mark Seiden wrote: i think we are having a misunderstanding here. any sort of opt-in or opt out doesn't work in the account takeover scenario, which is very common these days. No one on my buddy list

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jeffrey Walton
On Mon, May 20, 2013 at 8:55 PM, Jacob Appelbaum ja...@appelbaum.net wrote: James A. Donald: ... Zombie computers are seldom of high value. Some malware is designed to keep people communicating, under heavy watch; it is not always designed to abuse a system the traditional manner befitting

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread James A. Donald
James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged, how would *you* notice on your end? I would notice, because

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Jacob Appelbaum
James A. Donald: James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged, how would *you* notice on your end? I

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread James A. Donald
On 2013-05-21 3:08 AM, Mark Seiden wrote: (i know that at least jake and ian understand all the nuances here, probably better than me.) bus still, i would like you to consider, for a moment, this question: suppose there were a service that intentionally wanted to protect recipients of

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread James A. Donald
On 2013-05-21 4:50 AM, Mark Seiden wrote: you can advise whatever you fancy, but skype, google, microsoft are unlikely to agree to any such thing unless your client is a Really Big company who pays them a lot of money. and why should they even bother their lawyers? pretty much, their service Is

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread Kyle Creyts
Gmail only keeps in the clear what you leave in the clear. s/a hostile act/less useful to power users than filter but notify On Mon, May 20, 2013 at 8:48 PM, James A. Donald jam...@echeque.com wrote: On 2013-05-21 3:08 AM, Mark Seiden wrote: (i know that at least jake and ian understand all

Re: [cryptography] skype backdoor confirmation

2013-05-20 Thread James A. Donald
On 2013-05-21 12:41 PM, Jacob Appelbaum wrote: James A. Donald: James A. Donald: No one on my buddy list has been taken over, or if they have, they took care of it before I noticed. On 2013-05-21 10:55 AM, Jacob Appelbaum wrote: That is - how would they notice and if they were being logged,