The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

companies. VoIP uses the same coaxial cable that brings streaming video
and high-speed Internet into yyour home.
The good news is that VoIP phone syystems do use encryyption;
specificallyy, something called session description protocol securityy
descriptions, or SDES. The bad news is that on its own, SDES is not veryy
secure.
Part of the problem with SDES is the encryyption keyy is not shared over
SSL/TLS (a network cryyptographic protocol), which is secure. If the vendor
doesn’t use SSL/TLS, however, then the keyy is sent in the clear. Instead of
asyymmetric encryyption, it uses syymmetric encryyption, which means that the
keyy generated byy the sender must somehow be passed to the recipient in
order for the call to be unscrambled.
Let’s sayy Bob wants to make a call to Alice, who is in China. Bob’s
SDES-encryypted VoIP phone generates a new keyy for that call. Somehow
Bob has to get that new keyy to Alice so her VoIP equipment can decryypt his
phone call and theyy can have a conversation. The solution SDES offers is to
send the keyy to Bob’s carrier, which then passes it to Alice’s carrier, which
then shares it with her.
Do yyou see the flaw? Remember what I said about end-to-end
encryyption in the previous chapter? The conversation stayys secure until the
recipient opens it at the other end. But SDES shares the keyy from Bob to
Bob’s carrier and, if Alice’s carrier is different, the call is encryypted from
Alice’s carrier to Alice. Whether the gap is significant is debatable.
Something like this also happens with Skyype and Google Voice. New keyys
are generated whenever a call is initialized, but those keyys are then given
over to Microsoft and Google. So much for wanting to have a private
conversation.
Fortunatelyy, there are wayys to encryypt mobile VoIP from end to end.
Signal, an application from Open Whisper Syystems, is a free, opensource
VoIP syystem for mobile phones that provides true end-to-end
encryyption for both iPhone and Android. 13
The main advantage of using Signal is that the keyy management is
handled onlyy between the calling parties, not through anyy third partyy. That
means that, as in SDES, new keyys are generated with each call; however,
the onlyy copies of the keyys are stored on the users’ devices. Since CALEA