As a security guy, I can’t help but find Skype interesting.  Some people love it, others hate it.  Individuals flock to it, yet many corporations avoid it.  Some privacy advocates herald it, yet some in the open source community slam it.  Oh, and it uses encryption.

I don’t remember how it came up, but I was talking to Kathryn Schwab the other day and we ended up talking about Skype.  Kathryn is a Communications Consultant and owner of PRceptive Communications Inc. in Ottawa.  She explained,

“Skype has become an important part of my business and my personal life.  On the business side of things, I have two remote clients that I need to communicate with easily and inexpensively.  One of my clients resides in the UK and we have used Skype to collaborate on many projects.  The beauty is that you are communicating in real time, whether you’re ‘chatting’ or you’re video-conferencing. Speaking of video-conferencing, that is my most favourite feature.  I have family members that live very far away; we use Skype to video-conference.  There’s nothing like seeing someone’s face when you speak to them.  I’m grateful for this technology, as it has made my life so much easier and has helped (I think) to remain close to people.“

So what’s not to like about Skype?

Some dislike Skype because it is a closed, proprietary system.  In other words, the only thing that can talk to Skype is Skype and it doesn’t support a standard interoperable protocol like SIP.  (SIP, the Session Initiation Protocol is the most popular open standard for VoIP). While I’m all for standards, SIP is an exceptionally poor choice for Internet telephony, as anyone who has tried to use it from behind an older firewall or from a hotel can testify.  We have to use all sorts of workarounds just avoid annoying problems like audio only working in one direction.  Skype was designed from the ground up for the Internet and it just works.

Some dislike Skype because they can’t examine the cryptographic source code.  But I’m willing to bet that these same people use a regular telephone (no encryption there at all) and a mobile phone.  And you don’t see mobile phone manufacturers posting their source code either.

My frustration with Skype is that, while it’s awesome for videoconferencing with the kids while I’m on the road, I can’t interface it to my PBX.  For example, when somebody calls my VoIP number, I can’t have my PBX send the call to Skype unless I buy a Skype phone number and bounce the call back through the PSTN.  And Skype also doesn’t offer numbers in Canada.

But all that is about to change.  In fact, the entire VoIP landscape is about to change dramatically.  Skype recently announced that they will interoperate with SIP-based PBXs and have launched a beta program.  As a result, we will soon be able to make and receive calls between Skype and SIP-based PBXs without hitting a landline. Businesses will be able to directly integrate Skype calls into their existing phone systems with links on their Web sites. Click on the Skype link and you’re connected, all without ever touching the good o’l public telephone network. And mobile workers will be able to answer their business phone using Skype.

From a security point of view, it’s too early to understand all of the implications. But my advice to security colleagues is to start brushing up on VoIP and Skype now. When this catches on, it will move fast and furiously, primarily because it’s much less expensive than toll-free lines and Skype clients are free. It’s hard to beat free. And, if you, like me, were wondering why EBay bought Skype, wonder no more. They’re about to rock the telephony world.