Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.
A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
11–20 of 140 posts
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#12Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#13Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.
One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#14Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late.
Changing to slackbot seems like small fry!
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#15Earlier quoted context omitted.
One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).
Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#16The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#17The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#18it was a joke Verge
Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#19Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
#20The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!
Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.