Microsoft Reads Your Skype Chat Messages 275
An anonymous reader writes "A Microsoft server accesses URLs sent in Skype chat messages, even if they are HTTPS URLs and contain account information. A reader of Heise publications notified Heise Security (link to German website, Google translation). They replicated the observation by sending links via Skype, including one to a private file storage account, and found that these URLs are shortly after accessed from a Microsoft IP address. When confronted, Microsoft claimed that this is part of an effort to detect and filter spam and phishing URLs."
Alternate headline (Score:5, Insightful)
Alternate headline: Microsoft protects hundreds of millions of Skype users by going to the effort of checking even https URLs in chat for malware and spam
Re:Damned if they do... (Score:5, Insightful)
Not if you agree to it in the TOS.
This is news? (Score:5, Insightful)
How is this news? The price for free IM is that they read your messages and sell the info they gather to advertisers.
Re:Damned if they do... (Score:5, Insightful)
Nobody else was dumb enough to click the link.
You don't deal with many ordinary end users do you...
Re:Damned if they do... (Score:4, Insightful)
Problems with closed sorce (Score:3, Insightful)
Just in case you weren't already certain that they were monitoring your communications through Skype, they are.
Skype is not a secure communications channel. If this bothers you, use irc over i2p.
Re:Is there any way? (Score:5, Insightful)
Both Facebook and Google's chats use bog standard XMPP (aka Jabber). Normal, clueless people use Facebook to chat. The few that don't use Facebook use the chat inside Gmail, or the one installed on their smartphone. Encryption over XMPP is very common; You'd need to use a non-standard client (say, Pidgin), but it's feasible.
The major problem is that encryption requires support at both ends:
Even a totally proprietary chat network(if it's been cracked open far enough that 3rd party clients exist, or 3rd-party wrappers around the first party client or libraries exist) can be used to send encrypted payloads; but only if both users are set up for that(Pidgin with OTR, say, works just fine over AOL's 'Oscar' protocol; but only if both ends are using it. This is the real killer. If you don't have control over what your clueless compatriot is using, none of the client-side encryption options are going to help you much. Not supported in Google's gmail web app window thing? No deal. Not supported by cellphone's default chat client? no deal.
You'll still probably get SSL, from all but the shittiest chat services; but that only protects you from people watching the wire, not from the service provider(who is the man in the middle, with one SSL-protected connection to you and a second to your chat compatriot).
Same with email: it's less common than it used to be for email to go between the client and the mailserver in the clear; but it's still damn rare for messages to be encrypted at the client end and thus safe from the mailserver operator.
So what MS is saying.... (Score:2, Insightful)
.....is that they are Scroogling Skype users?
Re:I wonder... (Score:4, Insightful)
What sort of security measures would they have in place for systems whose job it is to poke every last probably-malware link that goes across skype?
I bet they run Linux.
Re:Damned if they do... (Score:5, Insightful)
That's funny. I remember their reputation always being "no one knows how the key exchange works and therefore nobody can trust it."
"Encrypted" means jack shit. Skype never had a reputation for being secure because they never showed anyone that they are. With any serious VoIP protocol (e.g. zfone) they tell you how it works. If the design is a trade secret, then it's a scam. You've known that for decades.
Don't Get Scroogled! (Score:3, Insightful)
Re:Damned if they do... (Score:5, Insightful)
Email spam filters are evil too! My ISP is reading my emails, OMG!
Re:Alternate headline (Score:5, Insightful)
Since you don't have any way to know exactly what they are doing, it is kind of silly to call that a 'problem'. Maybe they only do a HEAD because the response indicates authorization is required. Maybe they only visit a URL once, and already have visited the http site. Maybe they only do anything if something else triggers it (number of hits on a URL in a certain amount of time). You have no way of knowing that they only check https, you just know that in this particular case they only checked https. You have no way of knowing that that only get the headers, just that in this particular case they only got the headers.
Re:Damned if they do... (Score:5, Insightful)
I once renamed shutdown.exe from the Windows resource kit to DONOTRUN.exe, and sent it in a mail round to the company (in the I love you/Melissa days), warning people in the subject, and message to NOT RUN THE ATTACHED attachment.
People then started coming to me complaining they'd lost work because their computer had shutdown.
It's amazing, it really is.
Re:Damned if they do... (Score:4, Insightful)
It depends on if skype is sending all chats, or just the links. It depends on if microsoft is archiving what it receives or just checking them for malware. As usual, more information is required to make an informed judgement on this issue.