The move away from peer-to-peer has its virtues, but much is left unanswered.
It has been a slow transition, but Skype is finalizing its move away from a peer-to-peer system to a cloud-based one.

When it was first created, the Skype network was built as a decentralized peer-to-peer system. PCs that had enough processing power and bandwidth would be elected as "supernodes" and used to coordinate connections between other machines on the network. Similarly, text, voice, and video traffic would flow between peers, directly when possible (when intervening firewalls and routers were cooperative) or indirectly through other systems on the network when required.

This peer-to-peer system was generally perceived as being relatively private; with no central servers the assumption was that there was no central ability to perform wiretaps or other forms of eavesdropping. This belief was in fact mistaken.

The peer-to-peer connectivity brought with it certain problems, too. When large numbers of peers went offline—as happened in 2011 when a software bug made clients crash en masse—the system collapsed, as there were too few active nodes to create a fully connected network. Peer-to-peer connectivity also has some privacy issues; the exposure of IP addresses to peers was abused to perform denial of service attacks against victims, a problem that became distressingly common in the world of e-sports.
The Skype network was also designed for a world of permanently connected desktop PCs, with both bandwidth and processor power to spare. The growth of mobile computing and smartphones upset that assumption, adding a large number of Skype clients that were only intermittently connected and lacked the excessive bandwidth, processor power, and battery life to support acting as supernodes.

To help stabilize its network, Microsoft added dedicated supernodes in 2012 to ensure that there was a permanently available mesh of supernode systems regardless of the current client mix connected. However, it still used the peer-to-peer mesh of clients and supernodes.

Since then, Microsoft has developed a more conventional client-server network, with clients that act as pure clients and dedicated cloud servers. The company is starting to transition to this network exclusively. This transition means that old peer-to-peer Skype clients will cease to work. Clients for the new network will be available for Windows XP and up, OS X Yosemite and up, iOS 8 and up, and Android 4.03 and up. However, certain embedded clients—in particular, those integrated into smart TVs and available for the PlayStation 3—are being deprecated, with no replacement. Microsoft says that since those clients are little used and since almost every user of those platforms has other Skype-capable devices available, it is no longer worth continuing to support them.

As well as addressing certain constraints of the peer-to-peer network, the new cloud-based system is used to underpin various other Skype features. For example, on the peer-to-peer network file transfers required the recipient to be present and to accept the transfer (with the file subsequently transported directly between the clients). File transfers on the new network go via the cloud, allowing fire-and-forget transfers, even to recipients that are temporarily away. This also allows a file to be downloaded by multiple recipients, or by the same recipient on multiple systems, without needing it to be retransmitted from the sender each time. The new voice and video messaging capabilities operate similarly, using cloud storage to hold voice and video messages even when the receiving client isn't available.

New clients, including both the new UWP Windows client and the new Linux and Web client are built for the new network.

But what is most telling here is not what Microsoft's blog post says. It is what it doesn't say.

The Ed Snowden leaks raised substantial questions about the privacy of services such as Skype and have caused an increasing interest in platforms that offer end-to-end encryption. The ability to intercept or wiretap Skype came as a shock to many, especially given Skype's traditionally peer-to-peer infrastructure. Accordingly, we've seen similar services such as iMessage, WhatsApp, and even Facebook Messenger, start introducing end-to-end encryption.

The abandonment of Skype's peer-to-peer system can only raise suspicions here.

Microsoft's rationale for the system change is fair enough. The new network topology probably does make sense for the kinds of clients that are proliferating, and it's plausible that it will make building new features and capabilities much easier going forward. I don't personally think the work is being done for any nefarious purpose, not least because I don't think such a thing is even necessary: that nefarious purpose—spying on Skype communications—appears to be adequately addressed by the peer-to-peer network. I'm sure the technical rationale is accurate.

But the company's blog post completely ignores these concerns. Ctrl-F that thing for "privacy" or "security" and no results are found. Similarly "encryption." Nor do we see words like "specification" or "protocol." And in this day and age, it's not clear that any of this is really good enough.

Microsoft has been consistently silent on this. The Skype protocol remains undocumented and proprietary; we do not authoritatively know where and how encryption is used or what the limits of the system are. Historically, this made some sense: Skype's ability to work even behind strict firewalls and poorly configured home routers was an important and unique feature of the software. The open standards (SIP and related technology) barely worked even in scenarios that Skype handled with ease. But that's much less true today; the standards, and support for those standards, have improved. Skype's virtues can be found in any number of competing products.

The entire system is a black box. Much of this Microsoft inherited when it bought Skype; the client application actually contained anti-debugger systems to make it harder to reverse engineer: not only was it a closed network, it actively impeded any efforts to open it up, even slightly. These systems have now been removed, but this change was made only recently. Even with this change, the Skype clients lack any kind of a meaningful API, so we cannot even readily add our own encryption on top of the Skype network; this rules out layered systems, such as Off The Record, that add end-to-end encryption of text networks such as AIM and IRC.

Adding comprehensive encryption support is not trivial. There are things that Skype does that obviously pose challenges here—some of the time, Microsoft's servers must be able to encrypt or decrypt messages, because connectivity to the traditional phone network (using Skype to dial regular phone numbers or making Skype accessible from a regular phone number) means that it must be connected to an unencrypted network. End-to-end encryption may complicate features such as Skype's support for multiple simultaneous logins from different clients.

The proprietary nature of Skype's network has always been unsatisfactory. Skype has in many ways taken on an almost infrastructural role; it is used for a substantial volume of international calls connecting people all around the world. The secretive nature of the application feels ill-matched to an application this important.

The concerns over privacy serve only to highlight the awkwardness of Skype's secrecy. Skype's lack of clearly defined encryption and dependence on proprietary protocols isn't good enough in 2016. In re-engineering the Skype network, Microsoft could, and should, be making it a best-of-breed application that matches competing systems, such as iMessage, WhatsApp, FaceTime, and more, not just in terms of features, but also in terms of privacy.

Indeed, there is ample scope to go beyond what these systems offer; even a fully open, documented Skype network built on standard protocols should have considerable commercial value, thanks to the (eminently billable) telephone connectivity. Microsoft could do with Skype what Apple has refused to do with FaceTime, and actually document its specification.

Modernizing the Skype network to handle an increasingly mobile world is a sensible step, but it's not the only modernization Skype needed. It needs to handle an increasingly privacy-conscious, security-aware world, and that means shining light on parts that are currently in the dark.