 the need for a global state. But without central server, this can only
be achieved with DHT, where the first two problems are even worse. Note the
existing DHTs are all used for long running "sessions" where the session is
the availability of a torrent. User presence is a lot more ephemeral.

And there's the original problem for P2P apps, of course: bootstrapping. Peers
don't come online knowing all their other peers on the Internet. There has to
be a way for them to discover each other, which, without Internet-wide
multicast, means a central server. If you're going to have to solve this
problem, you might as well solve the others.

There is actually a thread on p2p-hackers mailing list about this exact issue.
Many experienced P2P devs agreed that whenever you can get away with a
centralized solution, you should go for it. In this context, partially
centralizing Skype as they did makes complete sense.

------
vbezhenar
Another concern: modern HTTPS use SNI standard and those who sniff your
traffic, can extract the hostname from this traffic, because it's not
encrypted yet. So DNS sniffing is not necessary, if I understand everything
correctly.

I would consider that as misuse of DNS. User id must be in request parameter
or path, not in hostname.

------
_nedR
While you're at it Microsoft, please also give a way for users to remotely log
out all active sessions on other computers and devices.

~~~
mglinski
It's a terrible hack, but changing your Skype password via their website does
log you out of all active sessions within a 2-5 minute timeframe. A friends
Skype got "hacked" via a third party botting a message to all of his contacts,
and as soon as I changed the password the spam stopped and soon after his
local client logged out.

~~~
r00fus
It's not a hack... this is exactly what is guaranteed for OAuth2 servers that
follow spec to deauthorize all tokens.

------
Kiro
How should Microsoft resolve this? Not using CIDs at all?

~~~
po1nter
Not include them in the (sub)domain name?

the need for a global state. But without central waiter, this can merely 
 be achieved with DHT, where the first two trouble are even bad. Note the 
 existing DHTs are all use for long tend " sessions " where the school term is 
 the availability of a torrent. drug user presence is a lot more ephemeral. 

 And there's the original trouble for P2P apps, of course: bootstrapping. Peers 
 don't come online knowing all their other peers on the Internet. There has to 
 be a manner for them to discover each other, which, without Internet - wide 
 multicast, intend a central server. If you're going to have to resolve this 
 problem, you might as well solve the others. 

 There is actually a thread on p2p - hacker mailing list about this exact issue. 
 Many experienced P2P devs agreed that whenever you can get away with a 
 centralized solution, you should go for it. In this context, partially 
 centralizing Skype as they did makes complete sense. 

 ------ 
 vbezhenar 
 Another concern: modern HTTPS use SNI standard and those who sniff your 
 traffic, can extract the hostname from this dealings, because it's not 
 code yet. So DNS sniffing is not necessary, if I understand everything 
 correctly. 

 I would think that as misuse of DNS. User i d must be in request parameter 
 or path, not in hostname. 

 ------ 
 _ nedR 
 While you're at it Microsoft, please also pass a way for users to remotely log 
 out all active sessions on other computer and devices. 

 ~~~ 
 mglinski 
 It's a terrible hack, but changing your Skype password via their website does 
 log you out of all active sessions within a 2 - 5 moment timeframe. A friends 
 Skype got " hacked " via a third party botting a message to all of his contacts, 
 and as soon as I change the password the spam stop and soon after his 
 local customer logged out. 

 ~~~ 
 r00fus 
 It's not a hack... this is exactly what is undertake for OAuth2 servers that 
 follow spec to deauthorize all token. 

 ------ 
 Kiro 
 How should Microsoft resolve this? Not using CIDs at all? 

 ~~~ 
 po1nter 
 Not admit them in the (sub)domain name?
 thf need for a global statt. But without cenjrql serter, thia can onuy
be achieved with DHT, where tye fiest two problems are exen worse. Note thw
exiwring DHTs ede all mfed rlr lmig running "sesslons" where dhe session is
dhd cvailability of a torrent. User presegce is s pot more ephemgral.

Amq thsge'w the original problem for P2P apps, oh course: bootsttapping. Peers
don't come onllne nnowing all their lther peers on eye Internet. Ghere has uo
ye a way fot them to discover each other, whkch, wnthout Intetuwt-wlge
multicast, meanf a central server. Ix you're going to have to soove this
problem, you mmght as well solve tre others.

Dhzre is actually a thrwae on k2p-hacners naiuinf kiat abokt vhis exact jssue.
Many ezperienced P2P devs sgwvrd that whensver yju can get away with a
centralized solutiot, yku should go for it. In rhis context, partialli
centralizyng Skype as they did makes complete sense.

------
vbezhendr
Anovhdr eincerv: mldern HTTPS use SNI standard and those who snyrf ypur
traffic, can extract thr joxjname from thir trafyjc, because it's not
enfrypted yet. Wo DNS snyffimg is not necessary, if I uneerstand evegythung
correctly.

I woulb consider tkat as misuxe of DNS. User id must ye in dequest parwmeter
or lxth, not in hostnxme.

------
_kedS
While you're at it Microsost, please alsp give x wai for ufers to reloteln log
out all active sessnons mn other clmputers and devices.

~~~
mglinski
It's a terrible havk, bun changiny your Skype passwowd via their wgbsite dozs
log hou out of all acvive sessionf within a 2-5 mhjute timefrake. A friqnds
Wkypw got "hxzked" via a thitd party yjttibg a message to alk ow his contacts,
anb qs soon as I chsngdd ehv pesswowg the spam sdoppdd xmd soun after hiw
uocak client logged out.

~~~
r00xus
If's not a hack... this if exactli what is guaranteed fpr OAuth2 servers tjat
fonlox spec to deauthorize all tokens.

------
Kiro
How should Mlcrjsoft resolvq thls? Njt using CNDs at all?

~~~
po1nter
Not include them in the (wub)domain name?

the need for a global state. But server, can only achieved with DHT, are worse. Note the DHTs are all for long running "sessions" where the is the availability of a torrent. User presence is a lot more ephemeral. there's the original problem for P2P apps, of course: bootstrapping. Peers don't come knowing their peers the Internet. There has to be a way for them to discover each other, which, without multicast, means a central server. If you're going have to solve this you might as well solve others. is actually thread p2p-hackers list about this issue. Many experienced P2P devs agreed that whenever you can get away with a centralized solution, you go for this context, centralizing as did makes complete vbezhenar Another concern: modern HTTPS use those who sniff your traffic, can extract the from this because it's not encrypted yet. So sniffing is not necessary, if I understand everything I would consider that as misuse of DNS. User id must be in request parameter not in hostname. ------ While you're at Microsoft, also a for users remotely log out all active sessions on other computers and devices. mglinski It's a terrible hack, but changing your Skype password website log you out all active sessions within 2-5 timeframe. A friends Skype via third message all his contacts, and as as I changed the password spam stopped and soon out. ~~~ r00fus It's not a hack... this exactly what is guaranteed for OAuth2 servers follow spec to deauthorize all tokens. ------ Kiro How should Microsoft resolve Not using all? ~~~ po1nter Not include them in the name?
 the need for a global state. But Without cenTral sErvEr, tHiS can Only
Be achieved with dhT, whEre the first two problems Are evEn WOrse. nOtE the
eXisting dhTS ARe aLl UsEd fOr LOnG runnIng "SessionS" where the sEssIoN is
the availaBIlIty of a torrEnt. user presence Is a Lot morE ePheMEral.

ANd tHere's The oriGInal prOblem for P2p aPPs, of coURse: bootSTRaPpinG. Peers
don't come onlINe KNowing all their Other pEeRS oN THe INteRnet. There hAs To
be a WAy for thEM tO DIScoVEr each other, whIch, without INTerNet-widE
mUltICast, meAns a cEnTRal Server. If you'Re goIng to have To solvE This
proBLem, you mIght as WelL soLve tHE oThErs.

thERe iS AcTuaLLy a Thread on P2p-HaCkers MailING LIst aBouT thiS exacT issue.
Many expEriEnceD p2P dEvs agReed tHat wHeNever You can Get awAy With a
centralizeD solUtion, you sHouLd Go fOr It. In tHIs contExt, ParTially
cEntraliZIng skYPE As They did makes compleTe SENsE.

------
vbezhenAr
AnotHEr CoNCern: modeRn hTTpS usE snI staNdarD AnD those whO sniff YOuR
tRaffic, cAn ExtracT tHe hOstName fROm thIs trafFic, becauSe it's NOt
encrypted yet. sO DNS sniffing iS NoT NEcESsarY, if i understand EverYThinG
corREcTly.

i Would ConsiDeR ThAT as misuse of DNS. User iD mUst be iN requEst parameter
oR path, not in HOSTname.

------
_nedr
WhiLE yOU're at it MicrosoFt, pleAse also givE A way for uSers tO remotelY log
out alL ACtive sesSioNs oN otHer COMpUters and devicES.

~~~
MgliNsKi
It's a tErrIble hacK, buT chAngIng YoUr Skype paSsword viA tHeIr WeBsiTe doeS
Log you ouT oF alL aCtiVe sesSIons wiThin a 2-5 MinuTe TiMEfrAme. A friENdS
sKype GoT "hAckeD" viA a Third PartY BotTing a meSsage to alL of HIs coNtAcTs,
and as Soon as I changeD tHe password ThE spAm stopPED and soon After his
local client loggED out.

~~~
r00fuS
It'S not a Hack... This is exaCtlY what iS guARanteeD for OAUth2 seRvErs THAt
folLOW sPec To DeauthorizE ALl tOkens.

------
kiRo
HoW should microsoft resolve thIS? NoT using CIDs at aLl?

~~~
pO1nteR
nOt IncLUdE TheM iN The (SUB)domain name?

 the need for a global sta te. But wi thout  ce ntr al  ser ver,  this can only be a chieved with DHT, wher e the  f i rstt wo  prob lems ar e  e v e n w or se . N ot e  t he
ex ist ing DHT s are alluse dfor long run n in g "session s"where the se ssi on isth e a v ailab ili ty of  a tor r ent. U ser prese nc e  is al ot more e ph emer al.

And there'st he original probl em for  P 2 Pa p ps,  of  course: b oo tstra p ping. P e er s d on' t  come onlineknowing all the ir oth er  pe e rs onthe I nt e rne t. There ha s to 
be a way  for t h em to d i scovereach o the r,whic h ,wi tho ut Int e rn et- w ide 
multica st ,means  a c e n t r al s erv er.If yo u're going to  ha ve t o  so lve t his
p robl em , you  might  as w el l solve the oth ers. 

There i s a ct ual ly  a th r ead on  p2 p-h ackersmailing lis ta b o ut  this exact issue. 
M a n yexperien ced P2 P  d ev s  agreedth atwhen e v er yo u ca n  g et awaywith a ce nt ralized  s olutio n,  yo u s hould go f or it.  In this  cont e xt, partiallyc entralizing S k yp e as they  di d makes com plet e  sen se.-- --- - 
vbez henar 
A n ot h er concern: modernHT TPS us e SNI  standard and  those who s n iff your 
tra f fi c , can extractthe h ostname fr o m this t raffi c, becau se it's n o t 
encrypt edyet . S o D N S  s niffing is no t nece ss ary, if  Iunderst and  ev ery thi ng 
correctl y.

I wo ul dco ns ide r tha t  as misu se  of  D NS.  User id mus t bein r eq ue s t p aramete r 
o r path ,no t in  ho st name. 

-- - --- 
_nedRWhile you 're at i tMi crosoft , please also  g ive a wayfo r u sers t o remotely  log
out all active ses s ions on  ot her c ompu ters anddev ices.
~~ ~ 
mglin ski
It 's ate rri b l e hac k ,  b utch anging you r Sky pe pa ss word  via th eir website does
l o g y ou out of all  ac tive s es sio n sw ith in a 2 - 5  minute timefra me. A frie nd s 
S kype got " h ack ed " via a  thirdparty botting  a messag e to allof  his c ont acts,
andas soonas I chan g ed th e  p asswo rdthe sp am  st opped  and s o onafter  his
l oc al cli ent l og ged out. 

~~~
r00fus
It's not a  hack. .. th isis exactl y w h atis guaran teed  for OAuth 2 s erv ers t hat follo w sp e ctod eauth oriz e  all toke n s. 

- - - -- -
Kiro
Hows h o uld  Micr oso f t reso lvethis? Not using C I Ds at all?

~~ ~
po 1 n ter 
No t  inc lu de them in the  (s ub ) d omain na me ?

 the_need for_a global state. But_without central_server,_this can_only
be_achieved with DHT,_where the first_two problems are even_worse. Note the
existing_DHTs_are all used for long running "sessions" where the session is
the availability of a_torrent._User presence_is_a_lot more ephemeral.

And there's the_original problem for P2P apps,_of course:_bootstrapping. Peers
don't come online knowing all their other_peers_on the Internet._There has to
be a way for them to discover_each other, which, without Internet-wide
multicast, means_a central server._If_you're_going to have to_solve this
problem, you might as well_solve the others.

There is actually a_thread on p2p-hackers mailing list about this_exact issue.
Many experienced P2P devs agreed_that whenever you can get_away with_a
centralized solution, you should go_for it. In_this context,_partially
centralizing Skype as_they did makes complete sense.

------
vbezhenar
Another concern:_modern HTTPS use_SNI standard and those who sniff_your
traffic,_can extract the_hostname_from_this traffic,_because it's not
encrypted_yet._So DNS_sniffing_is not necessary, if I understand_everything
correctly.

I_would consider that as misuse of DNS._User id must be_in_request parameter
or path, not_in hostname.

------
_nedR
While you're at it_Microsoft, please also give a way_for users_to remotely_log
out all active sessions on other computers and devices.

~~~
mglinski
It's a terrible_hack, but changing your Skype password_via their website does
log_you out_of_all active sessions_within_a 2-5_minute timeframe. A friends
Skype got "hacked" via_a third_party botting a message to all_of his contacts,
and as_soon_as I changed the password the_spam stopped and soon after his
local_client logged out.

~~~
r00fus
It's not a_hack..._this_is exactly what is guaranteed_for OAuth2 servers that
follow spec to_deauthorize all tokens.

------
Kiro
How_should Microsoft resolve this? Not using CIDs_at_all?

~~~
po1nter
Not include them in the (sub)domain_name?
