Security Basics mailing list archives

Re: Your opinion on Skype


From: Chandrashekhar Mullaparthi <chandrashekhar.mullaparthi () t-mobile co uk>
Date: Mon, 22 Aug 2005 18:31:32 +0100

Hi,

I can understand your reluctance. I think Skype would've gained the trust of network admins everywhere if they made it easy to block Skype but still encrypted everything. That way, people who are very conservative about what traffic goes out of their networks can block Skype and the rest can knowingly allow it. At the moment, it is very difficult to block Skype.

It is the viral nature of Skype which puts me off. It bypasses NAT devices and even proxy servers. At the moment it cannot pass through a proxy server which requires a password from the user but I can't see that being a barrier for very long. A user can install a local proxy which does not require a password which then authenticates itself to the corporate proxy. Or they might introduce that functionality into the Skype client software itself.

If I had to take a decision I would block Skype because I don't know what comes and goes through Skype. But blocking it isn't very easy as it can make itself look just like web browsing traffic.

On a Windows machine, even if you shutdown Skype it is still running in the background acting as a "super node" relaying calls for people who are behind very restrictive networks. That can use a lot of bandwidth and processing power. Although they are no known viruses/backdoors for Skype, as it increases in popularity it is only a matter of time before some flaw is discovered.

I will happily use Skype on my PC at home and my mobile phone when roaming but I wouldn't trust it in a corporate environment. If Skype made a corporate version of their product where the network admin can control who can get onto that "private" Skype network, you have a winner there for everyone!

cheers,
Chandru

On 18 Aug 2005, at 16:14, Joe George wrote:

I've been reading several articles including the link to one below regarding Skype software.  We have several users in our HQ office as well as field offices who were recommended to use Skype to keep in communication.  Several of us in our IT department are very apprehensive about it for many reasons including the fact it's not been through a pilot phase.  Aside from the VoIP functionality, I do not understand why they need it, because we have an enterprise IM client available, which you can integrate several other IM clients with.  A VoIP solution is not far away from being deployed throughout organization as well. 

Skype's claim of being secure does little to ease my mind.  Skype is not on the list of our supported applications, and as a low on the totem pole I am within the organization; I would be remiss by not mentioning my apprehension to the end-user of it being on their computer.   I just wanted to get your thoughts on it.  I've installed Skype on my own computer and haven't seen any adverse effects, but I do not use it often due to lack of time.  Have any of you deployed it successfully within your network? What is your opinion on the application?
 
http://networks.silicon.com/telecoms/0,39024659,39125816,00.htm


Thanks in advance,

Joe



Current thread: