Question for the tech-weenies here. How secure is Skype?

[dumbcat]

I think this falls under current events. My wife uses Skype VOIP to talk to family in Europe. I've read conflicting information on the web about how secure this is. I am told there is a proprietary encryption from the computer, and then the usual, supposedly hard to track routing of packets. And then decryption at the destination computer.

Any of the geeks here have a handle on the technology? How secure is a conversation from casual eavesdropping by ordinary hackers, and how hard for NSA to listen in? These are calls to outside the US, so I guess they are fair game for NSA. I'm told that the packets take some crazy routes due to Skype's hosting algorithms. I'm an EE and former communications engineer, but my knowledge and experience does not extend to VOIP. Anybody got a good link to a credible tutorial?

[PoliticAverse]

1. You may find this recent article of interest...

http://arstechnica.com/security/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/

[dumbcat]

5. Thanks. Interesting article, but .....

... it talks about IM and SMS messages. How about voice? Wouldn't that be a lot harder?

[bemildred]

2. Not. nt

[Renew Deal]

3. Nothing is truly secure.

There is really no such thing as a secure system once it is plugged into the Internet. That said, I don't think it's bad enough that you have to worry. Unless you're throwing social security numbers around, small talk about Aunt Magda in the old county is probably not very interesting to hackers. In fact, your cell phone is probably more insecure. I'm pretty sure those calls can be intercepted with a scanner. Also, if you are using a digital phone service through the cable company, you're already using VoIP.

I know this doesn't answer the technical part of your question, but maybe it makes you feel a little bit better.

[DCBob]

4. One of the most secure.

I heard the tappers have a hard time listening in due to the encryption.

[1-Old-Man]

6. Encryption? Breaking encrypted communications is what NSA does.

That is one of the NSA's prime missions, to break encrypted communications. If its electronic consider it theirs.

[RickFromMN]

7. I wouldn't assume anything is secure.

If the government couldn't snoop, the government would be complaining.

The government complains when it can't snoop on other things.

I can find articles claiming Apple's iMessage is too secure for the government liking.

Please do a google search: government iphone encryption
An example result is the following:
http://www.idigitaltimes.com/articles/16414/20130404/apple-imessage-surveillance-encryption-government-iphone.htm

I assume the government put pressure on eBay when skype was owned by eBay.
I assume the government continues to put pressure on Microsoft now skype is owned by Microsoft.
I assume the government has a backdoor, and will continue to have a back door, into skype.

I believe this is the only safe assumption to make.

[frazzled]

8. Well, I wouldn't give out my bank or credit card information while on it

But unless you have some reason, I'd be more afraid of your garden-variety hackers than the NSA. I talk to my husband on Skype all the time when he is out of the country, because it's cheap. Anyone is welcome to listen in, I suppose. Conversation usually consists of: what did you do today?; the light on the stairwell broke; I miss you; and, by the way, the X invited us to dinner on the 16th; can we make it? The cat threw up, again.

[Hekate]

12. Exactly.

[uppityperson]

9. k&r for an interesting question to mark to read later

[nadinbrzezinski]

10. Nope

[Hekate]

11. I wouldn't read my Social Security or credit card number over Skype.

But then dh is a DBA and doesn't believe much of anything is really secure.

[The Straight Story]

13. One sure way to find out

Speak some gibberish on it, then make plans for something terrorist sounding, more gibberish, and say Praise Allah a few times.

Wait for no knock warrant.

[Catherina]

14. Skype stopped being secure when Microsoft acquired it

...

Ryan Gallagher of Slate noted this week that one of the slides cited by the Washington Post was labeled a “User’s Guide for PRISM Skype Collection,” suggesting that the NSA has in place a method for eavesdropping on conversations conducted over the popular Web client acquired in 2011 by Microsoft.

According to the slide, NSA agents can listen in or watch Skype chats “when one end of the call is a conventional telephone and for any combination of 'audio, video, chat, and file transfers' when Skype users connect by computer alone.”

“This piece of information is significant for a number of reasons,” wrote Gallagher, but the most crucial perhaps is how it compares to Microsoft’s remarks last year. As RT wrote in 2012, Microsoft was awarded a patent that summer that provides for “legal intercept” technology that allows for agents to “silently copy communication transmitted via the communication session” without asking for user authorization.

At the time, Gallagher was one of the most critical reporters examining the patent, and grilled Microsoft relentlessly to see if this meant that a program previously considered highly-encrypted and tough to crack could provide a backdoor to government agents at the drop of a hat. However, Skype Corporate VP of Product Engineering & Operations Mike Gillet also explained to ExtremeTech.com that the company was making changes in its infrastructure, but that they were being done to “improve the Skype user experience.”

...

http://rt.com/usa/gallagher-nsa-microsoft-skype-653/

[Catherina]

15. Read these too

Skype's Encryption Scheme Possibly Broken

and

Think your Skype messages get end-to-end encryption? Think again
Ars catches Microsoft accessing links we sent in our test messages.

http://arstechnica.com/security/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/

[Frustratedlady]

16. This isn't technical, but real experience.

Around 10 or so years ago, my grandson was in Wales. He was calling to get some answers to questions about our ancestors that had a castle he would be visiting in Scotland the next week. I had a lot of information as we had possession of the diary one ancestor kept on his way to America.

Long story short, I researched the family on the internet to see if there was additional information I didn't have in the written family history I had. There was. However, there was another clan by the same name that had a horrible background of beheadings, kidnappings, etc., so as I was explaining all of this to him, in the hope he didn't get the clans mixed up. I suddenly realized the words I had been using might trigger someone who might be monitoring SKYPE. I didn't know if it was true or not that "someone" could be listening in, but decided I'd best warn my grandson in the event he was questioned when he tried to fly back to the US and expressed my concern to him. "Oh, my! I hope this conversation didn't put you on the no-fly list, or whatever they call it." CLICK! Dead silence.

I didn't dare call him back, so I let it go hoping he had heard the warning.

When he returned to the US, I asked him if he had hung up on me. He said he had not, but someone had clicked off at his end and he figured it was me.

I don't know if it was the government or coincidence, but no other family members or friends had that happen with their SKYPE calls to him.

Eerie, for sure.