Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

31–40 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#31

The single most terrible thing about Slack is the hostage holding of message archives. You don’t pay? Fine...you get 10k message history, no ability to set retention and Slack still stores all those messages forever, taunting me that they have it all and won’t let me do anything with them. That’s just user hostile. If I don’t pay, I shouldn’t have all that message history stored forever. Either let me set retention o…

OTOH... you really don't have much of a say if you're on a free plan. You're free to leave if you don't like their conditions for the free plan.

Re: What If All Your Slack Chats Were Leaked?

#32
post #11

Earlier quoted context omitted.

How big is your hard drive? How about on your phone? I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

> How big is your hard drive? 512 GB > How about on your phone? 256 GB > I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption? Of course. Share the key with a new joiner. Probably should be an option for admin, whether he wants to share (share the key) or does not want to share (generate new key and use it since that moment, old clients still remembe…

A single, shared key?

Granted, I don't know much about encryption, end-to-end messaging, or otherwise, but it seems like a Very Hard Problem to solve for something like Slack.

Re: What If All Your Slack Chats Were Leaked?

#33
post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

I’d guess the number of times a password has been shared in a private channel/direct message is a number with quite a lot of 0s behind it.

Re: What If All Your Slack Chats Were Leaked?

#34
post #7

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

Since when is not encrypting what could be sensitive communication ""isn't a problem here"?

So, I think this is a problem and that encryption and data security policies and audits would be a good thing. But your parent's point also resonated with me. This isn't a shocking expose of some giant new problem. Protecting proprietary communication has been a problem for as long as organizations have existed. It was a problem when the solution at Los Alamos was safes in offices, it was a problem with memos, it was a problem with faxes, then emails, and now, yes, Slack chats. It's a problem, people should work on it, but it's not news.

Re: What If All Your Slack Chats Were Leaked?

#35
post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

Re: What If All Your Slack Chats Were Leaked?

#36

The single most terrible thing about Slack is the hostage holding of message archives. You don’t pay? Fine...you get 10k message history, no ability to set retention and Slack still stores all those messages forever, taunting me that they have it all and won’t let me do anything with them. That’s just user hostile. If I don’t pay, I shouldn’t have all that message history stored forever. Either let me set retention o…

I worked on a project a while ago that used this as a feature. They were worried about a Freedom of Information request for chat archives (UK Govt linked) so intentionally didn't pay for Slack, so most of the message history wasn't available if a request came through.

Re: What If All Your Slack Chats Were Leaked?

#38
post #11

Earlier quoted context omitted.

Just let each client index locally

How big is your hard drive? How about on your phone? I guess there's also the problem of how to let a new joiner view previous messages. Can that be done with e2e encryption?

Not easily.

Re: What If All Your Slack Chats Were Leaked?

#39
post #7

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

Since when is not encrypting what could be sensitive communication ""isn't a problem here"?

Edit: I should have pointed out that the article doesn't say they don't encrypt the data, it just says they don't end-to-end encrypt it, which by definition would require it to be impossible for Slack or anyone else to read the messages (other than the users who sent them or were in the channel at the time they were sent). Only a handful or recent apps like Signal and Telegram even attempt to do this.

Any form of communication (or really any form of information storage) could be sensitive, that's my point exactly. There's literally no reason to mention Slack other than it's hot and the author could glom onto a trendy brand name to get people to read an article that is basically devoid of any novel content.

If a new sport which merges football, basketball, and chess become popular, we would see a bunch of articles 'People Who Play Chessketball are Getting Injured'. 'Chessketball has an Injury Problem'. 'Things you Need to Know before you Let Your Children Play Chessketball' Yes, people are more likely to be injured whenever they participate in any physical activity. Also when they ride a bike or go for a jog. Also, it turns out, if they don't do any physical activity at all they will suffer from heart disease.

Re: What If All Your Slack Chats Were Leaked?

#40
post #2

I've never understood why Slack can't add support for E2E encryption. I'm 100% positive they've got large clients demanding this functionality.

They could, but I don't think it would really add much benefit. One of the main features of Slack vs IRC is that Slack has persistent and consistent chat history. If you look at apps like Signal, when you log on from a new device your history isn't available, because of the end to end encryption used to store the messages. To view the history you would have to be able to decrypt it, but that means there has to be som…

In iMessage this was possible but all combinations of pairs of your devices had their own keys. When a new device was added you needed to allow it from a device already registered and they would then sync messages device-to-device. This has resulted in quite a lot of mangled histories.

Now with iMessage in iCloud, I do not know how the E2E encryption is done.

Post reply on HN