Related article from last fall discussing why Slack was supporting EKM rather than E2E encryption: https://motherboard.vice.com/en_us/article/kzj5xn/why-slack-...
Slack enables customers to control their encryption keys in enterprise version
171–178 of 178 posts
Re: Slack enables customers to control their encryption keys in enterprise version
#172Maybe this is more interesting than I initially thought. I was thinking this would just the encryption keys used to store the information for your whole organization Slack account. Instead, the keys seem to be much more granular, since you can revoke access to a single file, specific channel, workspace or organization level. [1] I see one benefit of this being able to securely throw away data. Like if you are doing w…
> Wonder how all this granularity works together with the search functionality.
Having implemented a similar system, I too greatly wonder that this.
My guess is they keep it in memory (e.g. ElastiCache) and populating the cache would require the keys.
Re: Slack enables customers to control their encryption keys in enterprise version
#173Earlier quoted context omitted.
People do use Slack because it looks better and is easier to use.... the features you're talking about are possible with IRC, it just requires work that the average consumer isn't willing to do. The other half of the equation is that IRC is better in ways that consumers don't care about, yourself included.
Can you deploy irc in a way that meets or exceeds the features provided by slack to an enterprise with thousands of users? And then teach Joanne from accounting how to use it?
We’re not disagreeing. That ease of deployment and use is Slacks killer feature. I’d go beyond that actually, there’s an entire suite of companies for whom their claim to fame is that exactly. And that’s predictable — technology is saving us time like it should.
Re: Slack enables customers to control their encryption keys in enterprise version
#174Earlier quoted context omitted.
Is it not worth Linux running on mainframes because mainframes are expensive? Is it not worth Kerberos being free software because the only real users of Kerberos are enterprises? Computing freedom for anyone is computing freedom, and contributes to a norm of user control instead of service provider control. This step is a very small step, and it only affects a few users. But it's still a step in the right direction.…
> Is it not worth Linux running on mainframes because mainframes are expensive? Honest question: what is it worth to me? I don't but into this "any linux usage is a win" mentality. Linux being used on tivos is worthless to me ( https://www.gnu.org/proprietary/proprietary-tyrants.en.html ), and it's hard to see why Linux running on hardware I will never have the opportunity to own should be worth anything to me either…
Still benefits you; more users to bolster the ecosystem (contributing to shared code), and code that later turns out to be useful (many-cpu systems were expensive supercomputers... right up until they started landing on desks).
Re: Slack enables customers to control their encryption keys in enterprise version
#175One thing I'm not totally clear on after reading the article is which AWS account the AWS KMS resides. Is it Slack's AWS account or the customer's?
https://slack.engineering/engineering-dive-into-slack-enterp...
This shows the KMS key is in the customer's AWS account.
Re: Slack enables customers to control their encryption keys in enterprise version
#176Earlier quoted context omitted.
So if someone else changes the password it doesnt show them? What if you legitimately chang your own password how does that work? I think I like the proof concept from Keybase unfortunately their name makes it sound like an SSH key repo and not an all in one chat and file sharing service. Also not quite as open as Matrix in the sense that people can choose other servers.
Right, the encryption isn't based on the password, but on encryption keys that are only on your devices. If you want to add a new device, you share the keys from one of your other devices to that new device. But just being able to log into an account (say by having the password) on a new device doesn't give any way to get the keys/read the encrypted messages.
So how easy is it to transfer between devices? This sounds like your keys could wind up in untrusted sources like if e.g. someone emails their keys to themselves, pretty sure then all bets are off that those keys are even secure?
Re: Slack enables customers to control their encryption keys in enterprise version
#177Earlier quoted context omitted.
I am not talking about putting TheLounge or Convos on a VPS node. I am talking about IRC administrators putting that, or a fork of that in front of their IRC infrastructure, so that you and your friends will have chat history / session persistence. The reference to VPS nodes was specifically for the case of WeeChat or Epic in a tmux or screen session as yet another alternate option. That is in no way related to TheLo…
> I am talking about IRC administrators putting that, or a fork of that in front of their IRC infrastructure ...at which point you're just reinventing Slack, except you're depending on random volunteers to pay for and manage the infrastructure of it.
Correct.
Re: Slack enables customers to control their encryption keys in enterprise version
#178Earlier quoted context omitted.
Right, the encryption isn't based on the password, but on encryption keys that are only on your devices. If you want to add a new device, you share the keys from one of your other devices to that new device. But just being able to log into an account (say by having the password) on a new device doesn't give any way to get the keys/read the encrypted messages.
So how easy is it to transfer between devices? This sounds like your keys could wind up in untrusted sources like if e.g. someone emails their keys to themselves, pretty sure then all bets are off that those keys are even secure?
Quite! If you don't have them backed up to your homeserver Riot asks you if you want to share the keys with the new device, you check that the device ID and key match, and then hit ok and it happens.
If you have them backed up to your homeserver, you just hit download from server then put in the password you encrypted them with.