Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

11–20 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#11

Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.

Slack has supported SSO via a variety of providers for quite a long time now. If G/O Media didn't bother setting up the integration, that's on them.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#12

Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.

One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#13

Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.

One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).

Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#14
The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies.

Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late.

Changing to slackbot seems like small fry!

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#15
post #13

Earlier quoted context omitted.

One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).

Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.

SCIM adoption isn't near where it needs to be. I guess yeah, this is the correct answer. We live in a world where SSO is considered an enterprise feature, I hope one day that it's considered default.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#16

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#17

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

I’m pretty sure this is one reason why my firm recently removed people’s ability to change their name on our videoconferencing system.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#20

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.

Presumably with SAML/SSO you can still change your slack display name and profile picture?
Post reply on HN