Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack enables customers to control their encryption keys in enterprise version

techcrunch.com

Post reply on HN
Print view View original

21–30 of 178 posts

Re: Slack enables customers to control their encryption keys in enterprise version

#21

Post by gregoriol »

ds wrote: post #14

I am not sure slack can ever meaningfully become encrypted while having persistence. All it takes is for a admin (or hacked admin account) to change the password of the target slack user and login as said user to view all their private messages. The encryption is mostly pointless as far as I can tell when all of it is circumvented by a changed password.

If you really want encryption with only access by the people in the room, you can use Matrix: it's not based on your password, but on the keys. If you have your keys (and encryption has been enable in the room), you and only you/your devices can read the messages.

Re: Slack enables customers to control their encryption keys in enterprise version

#22

Post by Svoka »

kop316 wrote: post #17

Out of curiosity, does Slack allow a single person multiple Screennames? I see a scenario where a single person can have different handles, so personal communication doesn't overlap with work related communication. But the article does not make that clear.

I think with Slack you register new account to every workspace you join. I don't think it even have single account for everything concept, and you'll have to get a new handle everywhere you join.

Re: Slack enables customers to control their encryption keys in enterprise version

#23

Post by chadlavi »

kop316 wrote: post #17

Out of curiosity, does Slack allow a single person multiple Screennames? I see a scenario where a single person can have different handles, so personal communication doesn't overlap with work related communication. But the article does not make that clear.

It works the other way; you can't _not_ have multiple screen names. Each workspace (which is the new, not as good name for a slack team) has its own unique set of users. Every workspace whose slack you join means you need to create a new user for that workspace.

Re: Slack enables customers to control their encryption keys in enterprise version

#24

Post by sgt »

phatbyte wrote: post #4
nukeop wrote: post #3

At this point, between no encryption, horrible clients, mistreatment of irc users, and questionable corporate behavior there's nothing in Slack that's worth saving it for me. Superior free software alternatives exist that bring the same or better functionality while also giving the user full control.

Which free alternatives?

I like Slack a lot except for the fact that it's a sluggish web app hidden away in a native window. I understand it gives them a lot of freedom to change things constantly, but what I would really want is a proper native app.

Re: Slack enables customers to control their encryption keys in enterprise version

#25

Post by avip »

tyingq wrote: post #11
tener wrote: post #9

Earlier quoted context omitted.

There are industries where you have no expectation of privacy at work because all comms are required to be monitored and stored due to the law . So this new feature really enables them to serve these customers who operate under such laws.

Sure but being that it's a distinct change some sort of indicator in the UI seems reasonable.

This change does not affect the normal user at all.

Re: Slack enables customers to control their encryption keys in enterprise version

#26

Post by pavel_lishin »

kop316 wrote: post #17

Out of curiosity, does Slack allow a single person multiple Screennames? I see a scenario where a single person can have different handles, so personal communication doesn't overlap with work related communication. But the article does not make that clear.

It's not like Discord, it's not a global profile that gets shared across all Slack instances - you can register with different email addresses per-slack.

Re: Slack enables customers to control their encryption keys in enterprise version

#27

Post by SEJeff »

kop316 wrote: post #17

Out of curiosity, does Slack allow a single person multiple Screennames? I see a scenario where a single person can have different handles, so personal communication doesn't overlap with work related communication. But the article does not make that clear.

Many slack instances such as regulated ones that require encryption keys use external authentication, such as Azure Active Directory, to authenticate users. If you are able to get multiple user accounts in the corporate directory service, they have bigger problems than multiple slack usernames.

Re: Slack enables customers to control their encryption keys in enterprise version

#28

Post by marcinzm »

ds wrote: post #14

I am not sure slack can ever meaningfully become encrypted while having persistence. All it takes is for a admin (or hacked admin account) to change the password of the target slack user and login as said user to view all their private messages. The encryption is mostly pointless as far as I can tell when all of it is circumvented by a changed password.

>All it takes is for a admin (or hacked admin account) to change the password of the target slack user and login as said user to view all their private messages.

An admin cannot change a user's password.

You can enable an account wide feature which allows admins to view all messages but that's separate and costs money. Also not what you described.

Re: Slack enables customers to control their encryption keys in enterprise version

#29

Post by geofft »

gregoriol wrote: post #18
tener wrote: post #9

Earlier quoted context omitted.

There are industries where you have no expectation of privacy at work because all comms are required to be monitored and stored due to the law . So this new feature really enables them to serve these customers who operate under such laws.

Matrix allows encryption with only access by people in the room, and even since they joined.

Right, and Matrix cannot be legally used by such customers. (I was the person who set up Slack compliance logging at my previous employer, which was SEC- and FINRA-regulated, moving from internal IRC. We weren't legally allowed to use even the chat window on the side of Google Docs etc.)

If the privacy of your work chats is important to you, there are lots of other jobs you can take. And of course nothing prohibited private chats between employees as long as they were not about work. I absolutely used Signal with friends who happened to be coworkers, but it was for things like planning our next D&D session and not planning out next trade.

Post reply on HN