GCHQ-developed phone security 'open to surveillance'

[silicon_toad2000]

Thanks to Mark in the chatroom for this one

http://www.bbc.com/news/technology-35372545

The security protocol is used to encrypt Voice Over Internet Protocol (Voip) calls.
In a blog, University College London researcher Steven Murdoch described vulnerabilities in how such conversations were encrypted.
GCHQ said it did not recognise the findings.
Dr Murdoch did not say that the vulnerability would give direct access to conversations, but that it would make it possible to undermine the system's security.
The network operator could listen in to calls, or authorise someone else to, and anyone who hacked the system would be able to eavesdrop, he said.

'Conflict of interest'

One of Dr Murdoch's chief concerns was that the security standard has "key escrow" by design - meaning, for example, that a third party has access to data sent between two people in a conversation.
This, he said, is an example of a backdoor.
In this case, it could allow an intelligence agency, or the organisation which is using the standard, to intercept phone calls, Dr Murdoch said.
"I think this comes from a conflict of interest within GCHQ in that they are there to prevent spying but they are also there to spy - so they facilitate spying," he told the BBC.
Dr Murdoch added that he was aware of two products which use the standard, both of which are government certified.

[WhiteLightningX]

Of course! Which is exactly what you want if you're big corporate or the gov. We all know that the less familiar tricks they find to gain entry are not going to be shared among the public anyway, which they keep in their arsenal for later use, and will be denied if later discovered to its fullest. And at the farthest point tried to be used as means of protecting the 'public.' Which of course is a load of BS to cover their rears.