How secure is Vonage? Does it use encryption for call data over the internet?

it is not encrypted with a "recognized" encryption scheme.

So, if someone were to sniff the traffic, could they play back the conversation, or do they use an "unrecognized" encryption scheme that prevents this?  (what do you mean by "it is not encrypted with a recognized encryption scheme"?)

I just got this back from Vonage:


Dear Vonage Customer,

We understand from your email that you would like to know whether your conversations are being encrypted between your adapter and the servers.

In response to your email we would like to inform you that the conversations are being encrypted between your adapter and the servers

If you have any questions now or in the future Vonage Customer Care is eager to assist you 24 hours a day, 7 days a week. Please visit our help center at http://www.vonage.com/help.php?lid=nav_help or send us an email from our Contact Us page at http://www.vonage.com/help_contactUs.php?lid=footer_contact. You can also call us Toll Free at: 1-VONAGE-HELP (1-866-243-4357).

Sincerely,

Vonage Customer Care





It sounds like they're saying that they DO use encryption...  Thoughts?

Well, just talked with someone in the advanced tech support and they set me straight...

Thanks!

It's just data so its no technical feat to encrypt it.  Did they actually say what kind of encryption was used?  I find it a bit odd that this is not listed as a feature.

If something is encrypted in a 'unrecognized' method it just means its not a standard 128 bit DES or something.  The downside with these 'unrecognized' methods is that is that are not as well challenged as the common well known methods.  This leads to the belief that it is much more likely that it can be cracked or otherwise comprimised due to a design flaw.  

Good for them if they have finally done it for real though.

A small local voip provider in my area was pushing encryption big and targetting business customers.  At the they launched they were the only or one of the very few providers to do encryption and none of the major voip companies did any encryption.  They used a modified IAX protocol with a standard 128 bit encryption.  This was a few years back now.

Their advanced tech support told me that they are not using encryption, but that the packets are scrambled so that if you try to play it back in the order the packets are sent, you'll end up with a garbled conversation.  Of course, this also means that you should be able to write a utility to re-order them if you really wanted to.  They have no plans to move to SRTP anytime in the near future, since they don't want to deal with any overhead for encryption.

I do very much hope that they offer encrpytion as an option at some point, but it's not here yet...

The packets being 'scrambled' is just a side effect of the network traffic not arriving in exactly the same order it is sent in - not any effort on thier part.  Each packet is numbered in sequence so as you guessed,  it is no big deal to order them properly.  

Pretty shameful that they told you it was encrypted in the email.  I would think that this would be a fairly common question.

As would I - I also think that they should at least extend the option for encryption for those with low enough latency to handle the extra overhead - besides, it wouldn't be that much overhead anyways...