Musings

Skype

… rhymes with hype. Yes, the bête noire of VoIP from the folks who unleashed KaZaA.

I downloaded the MacOSX client, and bought myself 10€ worth of SkypeOut credits. Calls to other skype users are free. Calls to POTS phones in North America, Western Europe, Australia and Chile are 0.017 €/min. Israel is 0.026 €/min and, should I ever feel the need to call (say) Angola, the price is a mere 0.142 €/minute.

My first act was to call my sister in California, whose reaction was that I sounded like I was talking over SpeakerPhone. Since I was using the built-in microphone in my laptop, that was an accurate assessment. Then I invested¹ in a BlueTooth headset. The audio quality is fantastic, and I can use it from across the room.

“Free?” I hear you say. “How do they intend making money?” Indeed, the Skype Technologies business model seems a bit dodgy. Granted, the peer-to-peer nature of the skype network (a legacy of its P2P filesharing heritage) keeps their costs very low. They don’t need to maintain a server infrastructure that a centralized VoIP network would require. Still, their costs are nonzero and the only revenue stream I see is the 10 or 20 € that people shell out for SkypeOut credits. But surely these prices are pretty close the cost of peering with PSTN. Moreover, after you’ve called your friends in Australia a few times, they may get the idea and download skype too; thereafter, you talk for free. How does Skype Technologies intend to make money? Perhaps they’re relying on the slightly obscure provision that your remaining SkypeOut credits expire 180 days after your last credit purchase. If you want to maintain the ability to make SkypeOut calls, you need to shell out a minimum of 20 €/year, even if your actual usage is much less. And there’s talk of rolling out other “premium” services, like voice-mail, at additional cost. But, however you slice it, this is by far the cheapest deal on long-distance you can find anywhere. You have to marvel at their cost structure, if they can make a profit under these conditions.

Another thing I wondered about is the encryption. Skype-to-skype calls use 256-bit AES encryption. To exchange AES session keys, skype uses 1536 to 2048 bit RSA public key encryption. But how do the two skype clients verify each others’ public keys? The FAQ says, “User public keys are certified by the Skype server at login.” The skype client allows you to login as any skype user. Presumably that means that the RSA key-pair cannot be stored locally. Does that mean that the client generates a new key-pair each time you login? Does anyone know how it actually works? Such questions would be all laid to rest if, like any good encryption product, skype were open-source, but it ain’t…

One of the virtues of skype, inherited from KaZaA and its P2P brethren is that it “just works,” even from behind a NAT router or firewall. The way it does this is to cheat. Skype uses port 80 (http) and port 443 (https), which are almost never blocked by even the most assiduous of firewalls. Clients behind NAT routers typically can’t accept incoming connections. So skype relies on “supernodes,” clients on the open internet which can accept incoming connections, to relay traffic between those clients which cannot.

Usurping a well-known port for a totally-different protocol is not good sportsmanship. And it limits the usefulness of the program. Obviously, machines behind firewalls or NAT routers can’t become supernodes. Neither can the MacOSX or Linux clients; not being SUID-root, they can’t bind to a privileged port. Nor can a Windows machine running a web server. This artificially limits the pool of potential supernodes, making the skype network less robust than it could be.

Skype could have used a distinct high-numbered port² (like any other new application). Most firewalls allow outbound connections to high-numbered ports. Only in a small fraction of cases – those with really draconian firewalls in place – would using a high-numbered port have prevented skype from working. And those are the cases where the IT managers probably have a good reason for firewalling those outbound connections. By masquerading as http(s), all you do is piss off your IT managers, who probably don’t want skype on their network and will take steps to ban it anyway.

Of course, some will ban skype just because of its connection with KaZaA. CERN bans it from their network and the stated reason seems a little shaky to me. Aside from the unsavoury nature of its cousins, the P2P filesharing programs, I don’t see why skype supernodes would pose an undue burden on the CERN network. It seems to be more of an “It’s the principle of the thing!” issue, than an actual concern about bandwidth or network performance.

Another complaint, voiced in some circles, is that skype doesn’t support the SIP Standard for internet telephony. Well, neither does iChat-AV³ (or AIM) and even the absence of an InstantMessaging Standard has not slowed their uptake. For me, skype-to-skype calls fill exactly the same niche as iChat-audio. Skype has slightly better sound quality; iChat also offers video capability. SIP uses centralized servers for presence and directory information. Skype’s P2P nature (even the user-directory is decentralized) obviates the need for centralized servers. SkypeOut, which presumably does require a server infrastructure (and which, for me, distinguishes skype from iChat and its brethren), doesn’t really need SIP either.

Standards are crucial for interoperability, but that only matters when you have someone you need to interoperate with. Skype has rocketed to the top of the VoIP heap because no one else had offered anything nearly as easy to set up, as high in audio-quality and as cheap to use.

Most of the other players in the VoIP game (both the Telcos and the “upstart” newcomers) seem dedicated to reproducing the “telephone experience” in all its details — from handsets to dialtones to the monthly bill — over the packet-switched internet instead of the circuit-switched PSTN. Skype has reconceived VoIP as a desktop PC application (though many PDAs and even some phones support skype). At the same time, they’ve reconceived what kind of network infrastructure is required to support VoIP.

When skype has some actual competition it needs to interoperate with, adding SIP support shouldn’t be that hard. Me, I’m not particularly worried. Right now, I have some phone calls to make…