Summary: Microsoft refuses to fix a DDOS risk which it knows about

Several years ago, before Microsoft acquired Skype, I had run some network monitoring tools and found out that Skype was revealing people's IP addresses very liberally. It was quite shocking at the time, partly because it connects people in each others' lists like they are some kind of botnet. The ISP can easily map this to show associations between people and their physical locations. Now this is characterised as a security issue in Skype -- one that Microsoft refuses to address:

It's been more than a year since the WSJ reported that Skype leaks its users' IP addresses and locations. Microsoft has done nothing to fix this since, and as Brian Krebs reports, the past year has seen the rise of several tools that let you figure out someone's IP address by searching for him on Skype, then automate launching denial-of-service attacks on that person's home.

I had noticed this well before the WSJ wrote about it and these days I use Linphone on the desktop, tablet, and phone. There are other SIP clients which are good and do not infringe people's rights to privacy, among other human rights. ⬆