said by dcurrey :

If they have a packet sniffer close to the network they may be able to get credentials that way since some voip companies transmit them in the clear.

said by neftv :

THAT is what should be talked about.

said by neftv :

THAT is what should be talked about.

said by Mango :

As harsh as it sounds, I have to agree with ViaTalk.

Based on my customers when I used to do rent-a-Mango, there are a great deal of people with completely unsecured wireless networks with not even admin passwords on their router. The majority of these people either (a) don't know and don't care or (b) know and still don't care. The smaller portion know and hired me to fix it.

In situations like these it is quite conceivable that SIP credentials could be sniffed. In fact, I hear that even WEP encryption is easyish to hack.

I don't feel nervous about using VoIP. I don't have open ports on my router and its access is disabled unless I'm using it. I don't even use wireless. I use long SIP passwords with a mix of uppercase and lowercase letters and numbers. However, inexperienced monkeys like my customers likely outnumber experienced monkeys like those of us in this forum.

Those of us who pay attention to internet security likely don't have to worry (though I check my CDR every week or two just as a matter of principle). It's those that I described above that the ToS update is for. If someone hacks my device, even if supplied, and I had (example) a completely unsecured wireless router, it's my fault. In this case, I'm asking for trouble.

m.

said by Mango :

In situations like these it is quite conceivable that SIP credentials could be sniffed. In fact, I hear that even WEP encryption is easyish to hack.

said by nitzan :

The only time we've had a user with this problem - it wasn't because his ATA was stolen (who steals an ATA anyway?!?) - it was because his Asterisk box had easy passwords and was hacked.

From our perspective - we're not going to "eat" the costs of fraud caused by the customer's negligence. What we did for that user is gave him a partial refund - but keep enough to cover our own costs.

In our case though (as opposed to ViaTalk) - our system is prepaid, meaning the above customer only had $30 in his account and lost a grand total of $30. When his balance reached zero - the calls stopped connecting which limited his liability for fraud to the amount of credit he had in his account.

With ViaTalk (for example) however- billing is POST paid which means a customer who gets hacked has no liability limit. The hackers can go on to make thousands of Dollars worth of calls.

I'm not sure if VT has their own monitoring systems to identify and suspend accounts with overusage - but I don't see how they can even attempt to bill someone hundreds or thousands of Dollars. The customer can simpy refuse to pay and VT will have a very hard time collecting.