Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

71–80 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#71
post #3

Earlier quoted context omitted.

Probably how they do search.

Just let each client index locally

This seems to be how Matrix/Riot plan to enable search in E2E rooms:

  - https://github.com/matrix-org/matrix-search
  - https://github.com/vector-im/riot-web/issues/2548

Re: What If All Your Slack Chats Were Leaked?

#72
I worked for a fortune I reported it to security. Next day I'm suspended. Turns out security did it because they wanted to search through 'just in case' but didn't want to go through the process properly.

Either it was my fault or they were incompetent, guess which one they chose. I was forced to quit eventually.

Re: What If All Your Slack Chats Were Leaked?

#74
post #24
post #9

First thought: who the hell would be interested to read thousands of lines of discussions like how to name a field in REST response or notifications of someone making a build xD

A variation of this argument always seems to come up in discussions about privacy. Yes, 99.9% of what you do or say in your daily life is likely of no consequence. But every now and then you may do or say something that could be used against you, and someone who has many years worth of data collected on you can probably find quite a few such bits of info. Among all of your internet "transactions" probably less than 0…

^ This

People rant about coworkers and managers, complain about their spouses, joke about doing something illegal/stupid, compare themselves (favorably or not!) against a competitor, and share the occasional off color story/picture with a friend.

Should those things happen on corp systems/network? Most of them, no. Do they? Absolutely.

When we do those things, we don't think about it because we all have the immediate context, feelings, and stress of the situation in addition to knowing the other person involved.

If an opposing attorney or law enforcement reads it years later without the context and knowing the people, they can't interpret it the same way.

Re: What If All Your Slack Chats Were Leaked?

#75
There seems to be a fundamental assumption here that's just completely wrong, and that is that there's a way to guarantee that your chat logs /email /search history /whatever can ever be 100% secure from disclosure. This is as wrong as assuming you don't need backup because you have RAID, excellent malware protection, are fully patched, have great sprinklers, are geologically stable, not in a flood plain, etc.

You need to start from the assumption that it can happen here and take steps to ensure that damage is minimal /recoverable. Part of that is policy, part culture, another part is technical but none are sufficient by themselves. On the tech side, look at systems designed to comply with data protection laws.

Re: What If All Your Slack Chats Were Leaked?

#76

once worked for a start-up that went through a high amount of churn and employee turnover. one of the pain points was the know-how being locked inside Slack threads and we had hit the 10K message limit months before I joined. The place was also politically toxic and the CEO was mostly the cause of this. Initially when I had still some passion left I suggested to move Slack to a self-hosted Zulip installation (threade…

In case anyone runs into this in the future, Zulip has a few features that could help:

* You can set a message retention policy that will delete each message after N days. (We're building the UI for it, but currently you can email support@zulipchat.com for help on turning it on.)

* On Zulip Cloud, you can set a message visibility limit that will save all your messages (e.g. for legal/compliance reasons), but only the last N messages will be visible to the team.

Re: What If All Your Slack Chats Were Leaked?

#77
post #2

I've never understood why Slack can't add support for E2E encryption. I'm 100% positive they've got large clients demanding this functionality.

Define "end."

If one definition includes "the server(s)" then I'm positive it does at least on their Enterprise product, which notably last time I looked was the only one that could be considered HIPAA-compliant, aka "no your two - site medical practice can't use Slack to chat between the sites and coordinate anything involving patients."

Re: What If All Your Slack Chats Were Leaked?

#79

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about. For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a…

What you say is all true, but some kind of end to end encryption would reduce the risk, or at-least impede mass leaking of data. That seems to be the entire point of the article.

Re: What If All Your Slack Chats Were Leaked?

#80
post #3

Earlier quoted context omitted.

Probably how they do search.

Just let each client index locally

So, is each web client going to download the full history so it can build an index? I like being able to login from anywhere, but building a local index could take some time, and I definitely don't want that to happen when I first open slack in the browser.
Post reply on HN