[clug] Open source Skype replacement needed

[Kevin Pulo]

On Mon, Jul 04, 2011 at 10:32:33AM +1000, Sam Couter wrote:

> Francis Whittle <fj.whittle at gmail.com> wrote:
> > Of course, I suppose that there's all these security algorithms to avoid
> > line tap style hacking from points on the network, but there is truly no
> > way to be completely sure it's not broken in some way.
> 
> The surest way is to use end-to-end encryption. Skype has a built-in man
> in the middle attack vector and always has. This is old news. End-to-end
> encryption doesn't involve trusting some third party to keep your
> conversation secure.

While this is true, for it to be useful in practice you also need to
address the issue of identification, ie. being sure that the
end-to-end encryption key that you're using really does belong to the
person you think it does (which is particularly tough if you don't
know the other person a-priori).  You also need to trust everything
between the endpoint and your senses, which means the sets of
hardware, operating systems, applications and libraries on both ends.
Which isn't as bad as it sounds, compared to having to trust all the
other stuff along the way as well.

Kev

-- 
Kevin Pulo
kev at pulo.com.au
http://www.kev.pulo.com.au/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/linux/attachments/20110704/8a7c458f/attachment.pgp>