Skype

[TFinnegan]

Everyone always jumps up and down and calls me crazy when I tell them I'd rather not use skype.

Aside from the fact that the network admin at my job swears that it's got holes you could drive a truck through, AND the fact that Skype/E-bay regularly divulge data to the US govt, I thought I'd post this missive, copied straight from the Wiki:

Flaws and potential flaws
While Skype encrypts users' sessions, other traffic including call initiation can be monitored by unauthorized parties.
Chief among security complaints are the following:

----By default, Skype also records data about calls (but not the message contents) in a "History" file saved on the user's computer. Attackers who gain access to the computer can obtain the file.

----Skype can consume other users' bandwidth. Although this is documented in the license agreement (EULA), there is no way to tell how much bandwidth is being used in this manner.

----There are some 20,000 supernodes out of many millions of users logged on. Skype Guide for network administrators claims that supernodes carry only control traffic up to 10 kB/s and relays may carry other user data traffic up to 15 kB/s (for one audio conference call). A relay should not normally handle more than one "relayed connection".

----Skype's file-transfer function does not integrate with any antivirus products, although Skype claims to have tested its product against antivirus "Shield" products.

----Skype does not document all communication activities. This lack of clarity as to content means that systems administrators cannot be sure what it is doing. (The combination of an invited and a reverse-engineered study taken together suggest Skype is not doing anything hostile). Skype can be easily blocked by firewalls.

----Skype consumes network bandwidth, even when idle (even for non-supernodes, e.g., for NAT traversal). For example, if there were only 3 Skype users in the world and 2 were communicating, the 3rd computer would be taxed to support the application, even if not using Skype at the time. The large number of Skype computers means that this activity is diffuse, it can lead to performance issues on standby Skype users, and presents a conduit for security breaches.

----Skype implicitly trusts any message stream that obeys its protocols

----Skype does not prohibit a parallel Skype-like network

----Skype makes it hard to enforce a corporate security policy

----Lack of peer review prohibits external security code verification.

----Skype creates a file called 1.com in the temp directory which is capable of reading all BIOS data from a PC.According to Skype this is used to identify computers and provide DRM protection for plug-ins.

----The privacy of Skype traffic may have limits. Although Skype encrypts communication between users, a Skype spokesman did not deny the company's ability to intercept the communication. On the question of whether Skype could listen in on their users' communication, Kurt Sauer, head of the security division of Skype, replied evasively: "We provide a secure means of communication. I will not say if we are listening in or not."[12] In China filters text according to government requirements. This suggests that Skype has the capacity to eavesdrop on connections.[13] One of Skype's minority owners, eBay, has divulged user information to the U.S. government.

---The URI handler that checks URLs for verification of certain file extensions and file formats uses case sensitive comparison techniques and doesn'€™t check all potential file formats.

-While Skype does encrypt most of its communications, packets containing advertisements are unencrypted which are pulled from several places, exposing a cross-site scripting vulnerability. These ads can easily be hijacked and replaced with malicious data.

Scary monsters, or hyper paranoia?
I dunno.
And thats just it.
I DONT KNOW.
Therefore...
...no skype for me

Nice to know I'm not alone

---