Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

Post reply on HN
Print view View original

51–60 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#51

Post by RHSeeger »

hsnewman wrote: post #35
deegles wrote: post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

Generally, hashed. Ie, not reversible.

Re: What If All Your Slack Chats Were Leaked?

#52

Post by [deleted] »

hsnewman wrote: post #35
deegles wrote: post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

[deleted]

Re: What If All Your Slack Chats Were Leaked?

#53

Post by sleepychu »

hsnewman wrote: post #35
deegles wrote: post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

There's a difference between encrypted (implies can be decrypted) and hashed (a one way function which cannot be reversed).

In general, I shouldn't be able to tell you your password, I should just be able to tell you if the password you just gave me is the one you gave me before.

Re: What If All Your Slack Chats Were Leaked?

#54

Post by jacobsenscott »

ltbarcly3 wrote: post #4

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

What if you read the article?

Re: What If All Your Slack Chats Were Leaked?

#55

Post by perlgeek »

> Slack is one of many Silicon Valley unicorns going public this year, but it’s the only one that has admitted it is at risk for nation-state attacks.

Gosh, everyone who runs a computer is at risk for nation-state attacks.

The real question is: how high is the risk?

The risk section of an S1 tries to list every imaginable threat as a risk, without any assessment of the probability or impact (the two components of risk). Using this is a source for such an article is simply wrong.

Re: What If All Your Slack Chats Were Leaked?

#56

Post by groovybits »

ltbarcly3 wrote: post #4

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

The problem you mention is different, and the severity is as high as the most sensitive content that's been posted.

As is the case with most chat platforms, the technical safeties put in place only serve to protect _legitimate_ users. The problem you're referring to is a matter of _illegitimate_ users or _insider-threats_.

* What if I copy-paste a sensitive conversation to a third-party?

* What if I export conversations or user accounts to a third-party?

* What if I grant an unauthorized party access to a conversation that they wouldn't otherwise be able to see?

In-transit encryption and encrypted storage do not solve these issues, because an insider threat inititated the action.

Re: What If All Your Slack Chats Were Leaked?

#57

Post by swebs »

hsnewman wrote: post #35
deegles wrote: post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

If they don't store the password encrypted or in plaintext, how would they be able to authenticate you? It must be stored somehow, either plaintext or encrypted (preferred).

https://en.wikipedia.org/wiki/Bcrypt

Re: What If All Your Slack Chats Were Leaked?

#58

Post by smt88 »

dsfyu404ed wrote: post #19

I've been spending all these years holding my tongue because as a matter of principal I don't write anything I don't want a permanent record of and it would be nice to see all that overhead pay off or more accurately, it would be nice to see people get burned for being sloppy. So no, I wouldn't really stand to lose anything if everything I ever said on company chat was published in an easily searchable format online.

1) Very few Slack users are chatting as though their messages could become public at any moment. Maybe you don't have a problem, but this article isn't about one person with extreme discipline.

2) There's no way to know now what you'd want to be private in the future.

For example, let's say you're gay and mention your boyfriend casually in a Slack chat. Then your country outlaws homosexuality. Suddenly, a casual detail becomes a secret you're terrified of getting out.

You can apply this analogy to your religious beliefs, traveling to certain countries, or even reading certain websites. You just don't know what the public or your govt will find unacceptable in the future.

Re: What If All Your Slack Chats Were Leaked?

#60

Post by Analemma_ »

ken wrote: post #16
ltbarcly3 wrote: post #4

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

"In hindsight, complying with the company's Document Retention Policy (which at Netscape was basically, ``shred anything within 90 days unless you can't get your job done without it'') might have been a good idea." [1] Do companies no longer have Document Retention Policies? That seems like the bigger piece of the story here. [1] https://www.jwz.org/gruntle/rbarip.html

Netscape was before Sarbanes-Oxley though, which mandates extensive retention policies for business communication.
Post reply on HN