Wanna know what product your competitor is working on? Try Slack
1–10 of 145 posts
Re: Wanna know what product your competitor is working on? Try Slack
#2Wow. This is a very serious security flaw. You should never assume that usernames (especially email addresses) are unknown to attackers.
Re: Wanna know what product your competitor is working on? Try Slack
#3This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't.
It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.
Re: Wanna know what product your competitor is working on? Try Slack
#4The site seems to be down at the moment.
Here is a cached version [1]
The gist of it: the slack mac client seems to ask you for your groups before properly authenticating you - hence if you put in the email address of a competitor (or famous person), you can see which groups they belong to, which might be valuable information.
(haven't tried it myself, just summarising the post)
[1] http://cc.bingj.com/cache.aspx?q=http%3a%2f%2fwww.tanay.co.i...
Re: Wanna know what product your competitor is working on? Try Slack
#5This issue actually seems to be even worse: You don't need a valid email alias to get a list of all teams. Just the domain name.
Re: Wanna know what product your competitor is working on? Try Slack
#6Sometimes the site isn't available, so voila:
http://webcache.googleusercontent.com/search?q=cache%3Awww.t...
Re: Wanna know what product your competitor is working on? Try Slack
#7WTF - "that matches your domain". Big ouch.
Re: Wanna know what product your competitor is working on? Try Slack
#8You don't have to use the mac client: https://slack.com/signin and test@microsoft.com yields the same result.
Re: Wanna know what product your competitor is working on? Try Slack
#9I cannot believe the incompetence.
Re: Wanna know what product your competitor is working on? Try Slack
#10I haven't tried the hack, but it's something that had occurred to me for a while. We're using Slack internally and I've been wanting to get everyone in our larger organization to use it. Anyone with an email using our domain would be able to join. Which is ok with me. The only real flaw here is showing which groups are available (many of which can be client names or project names or product names that have yet to be launched). This is a serious lapse on their part