Sunday, January 6, 2008

VoIP Reminder - ZFone

The VoIP industry has been amazingly uninterested in figuring out how to protect the privacy and security of VoIP users. Of all the commercial service providers, only Skype provides encryption and authentication. Fortunately, Phil Zimmerman, the inventor of the best encryption software for all platforms, PGP (Pretty Good Privacy), has turned his talents to protecting VoIP. This is good news because eavesdropping on VoIP traffic is just as easy as sniffing any TCP/IP traffic. So we now have the ZFone.

ZFone operates invisibly, without needing administration and setup the way PGP does. With PGP you have to set up a public key infrastructure (PKI). A PKI performs authentication, verifying that the person you're communicating with really is who he or she claims to be, prevents eavesdropping and alerts you if the transmission has been altered in transit. (more) (original alert)

Extra Credit...
VoIP calls are easy to eavesdrop on—anyone with access to any wire that carries your transmissions can snoop with trivial ease. There is a possible remedy, but it's not widely used yet, and that is the ZRTP encryption protocol. I think it shows the most promise, as it is lightweight, provides very strong encryption, and—best of all—requires no user or administrator intervention; it Just Works. ZRTP is somewhat like cell phone encryption, except that it's not weak or easily broken. Zfone is the software implementation of ZRTP, and now you can get a plugin for your softphones. It costs nothing but a bit of time to try it out. (more)