Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

Post reply on HN
Print view View original

11–20 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#11

Post by s_kilk »

quotemstr wrote: post #5
sroussey wrote: post #3

Earlier quoted context omitted.

Probably how they do search.

Just let each client index locally

How big is your hard drive? How about on your phone?

I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

Re: What If All Your Slack Chats Were Leaked?

#12

Post by madeofpalk »

mapcars wrote: post #9

First thought: who the hell would be interested to read thousands of lines of discussions like how to name a field in REST response or notifications of someone making a build xD

I'm sure the Gawker employees thought the same thing, until their chat logs were brought up in court

http://nymag.com/intelligencer/2016/03/what-hulk-hogan-taugh...

https://splinternews.com/the-gawker-hulk-hogan-trial-and-the...

Re: What If All Your Slack Chats Were Leaked?

#13

Post by james_pm »

The single most terrible thing about Slack is the hostage holding of message archives. You don’t pay? Fine...you get 10k message history, no ability to set retention and Slack still stores all those messages forever, taunting me that they have it all and won’t let me do anything with them.

That’s just user hostile. If I don’t pay, I shouldn’t have all that message history stored forever. Either let me set retention on my messages or delete anything over 10k automatically. Don’t hold my content hostage and make it completely inaccessible and un-deletable unless I pay.

Re: What If All Your Slack Chats Were Leaked?

#14

Post by vbezhenar »

s_kilk wrote: post #11
quotemstr wrote: post #5

Earlier quoted context omitted.

Just let each client index locally

How big is your hard drive? How about on your phone? I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

> How big is your hard drive?

512 GB

> How about on your phone?

256 GB

> I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

Of course. Share the key with a new joiner. Probably should be an option for admin, whether he wants to share (share the key) or does not want to share (generate new key and use it since that moment, old clients still remember old keys and can decrypt things).

Re: What If All Your Slack Chats Were Leaked?

#15

Post by johannes1234321 »

s_kilk wrote: post #11
quotemstr wrote: post #5

Earlier quoted context omitted.

Just let each client index locally

How big is your hard drive? How about on your phone? I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

Yes, that could be done with e2e encryption. Typically a setup would use one secret key for crypting one (set of) message(s) and that key would be encrypted in a way that all authorized users can decrypt it. A new user then only needs access to the group key, which can be done cheaply (by anybody with access to the group key and all user's public keys)

Re: What If All Your Slack Chats Were Leaked?

#16

Post by ken »

ltbarcly3 wrote: post #4

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

"In hindsight, complying with the company's Document Retention Policy (which at Netscape was basically, ``shred anything within 90 days unless you can't get your job done without it'') might have been a good idea." [1]

Do companies no longer have Document Retention Policies? That seems like the bigger piece of the story here.

[1] https://www.jwz.org/gruntle/rbarip.html

Re: What If All Your Slack Chats Were Leaked?

#17

Post by ltbarcly3 »

roemance wrote: post #2

I've never understood why Slack can't add support for E2E encryption. I'm 100% positive they've got large clients demanding this functionality.

They could, but I don't think it would really add much benefit. One of the main features of Slack vs IRC is that Slack has persistent and consistent chat history. If you look at apps like Signal, when you log on from a new device your history isn't available, because of the end to end encryption used to store the messages. To view the history you would have to be able to decrypt it, but that means there has to be some mechanism for users joining a channel for the first time to decrypt the history of that channel (unless you want to break that functionality). Unless there is some really neat cryptography trick I'm not aware of, that would mean you can't have end to end encryption where each user's data is encrypted in a way that is opaque to everyone except user(s) in the chat like Signal or Telegram.

Now I guess you could set up some kind of broker system and have like a different encryption key per channel or per conversation or something, which would at least mean some hacker has to get both the archived chats as well as the keys. This would make stealing chat histories more complicated, but not less possible.

Re: What If All Your Slack Chats Were Leaked?

#18

Post by leppr »

roemance wrote: post #2

I've never understood why Slack can't add support for E2E encryption. I'm 100% positive they've got large clients demanding this functionality.

A read over Keybase's blog [1] makes one realize how non-trivial building a secure team chat is.

We're still at a point in time where 99% of communities are ready to make exactly 0 compromise for privacy over usability. Slack is catering to the 99%.

[1]: https://keybase.io/blog

Re: What If All Your Slack Chats Were Leaked?

#19

Post by dsfyu404ed »

I've been spending all these years holding my tongue because as a matter of principal I don't write anything I don't want a permanent record of and it would be nice to see all that overhead pay off or more accurately, it would be nice to see people get burned for being sloppy. So no, I wouldn't really stand to lose anything if everything I ever said on company chat was published in an easily searchable format online.

Re: What If All Your Slack Chats Were Leaked?

#20

Post by ken »

mapcars wrote: post #9

First thought: who the hell would be interested to read thousands of lines of discussions like how to name a field in REST response or notifications of someone making a build xD

Netscape, 1998: "And I keep thinking to myself, Microsoft is going to pay some jackass lawyer $200 and hour to find out that we hate our cafeteria food, don't like the security posters, had a sucky newsfeed, and think ``Navigator'' was a cooler name than ``Communicator''." [1]

Just because you don't think you have anything interesting doesn't mean a competitor isn't going to subpoena it years later.

[1] https://www.jwz.org/gruntle/rbarip.html

Post reply on HN