Even if they fixed this flaw, you could still reverse this technique by using a dictionary attack against {{ name }}.slack.com (e.g. eng.slack.com), and parse out the given domain name.
Wanna know what product your competitor is working on? Try Slack
61–70 of 145 posts
Re: Wanna know what product your competitor is working on? Try Slack
#62Nice, they eat their own dogfood http://imgur.com/Xs2QRZa
Re: Wanna know what product your competitor is working on? Try Slack
#63Earlier quoted context omitted.
I'm sure way more businesses use Skype and Hangouts than Slack and HipChat.
Skype is actually pretty good for teams. I used to work at a company where it was our primary medium of communication, and we were almost forty people. It's extremely easy to create a group chat in Skype and destroy it with IRC OPs like features. It is also tempting to use since Skype provides a way to initiate a voice call right there from the chat. And one can always access the chat history as well. People have als…
Skype bots that have to be hosted with someone clicking the buttons in the UI, or that get broken every time Skype updates, no?
I wouldn't want to trust any business use to something that doesn't provide a documented API that I can use from my own code.
Re: Wanna know what product your competitor is working on? Try Slack
#64This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.
It was reported to them before, they said it's not a bug:
@rootlabs: Got the expected "not a bug" from @SlackHQ so
feel free to see names of MSFT, Google chats via login
info leak. http://t.co/kldKXN7NTf
Re: Wanna know what product your competitor is working on? Try Slack
#65This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.
It was reported to them before, they said it's not a bug: @rootlabs: Got the expected "not a bug" from @SlackHQ so feel free to see names of MSFT, Google chats via login info leak. http://t.co/kldKXN7NTf https://twitter.com/rootlabs/status/499723782244675584
13th August? man, someone messed up.
Re: Wanna know what product your competitor is working on? Try Slack
#66I can see that both Microsoft and Google have tried Slack at least. This doesn't mean they are still using it (vice versa). Since Skype is not really light-weight anymore and Google chat did not really take off, It looks like that Slack found himself a good spot in between.
My 'Open Source Strategic Engagements' team at MSFT is totally using it. Slack is awesome. It has a good Skype integration, which is how we can call each other. It's the best chatroom solution I've seen in a while. Skype and Lync are trying to do something else and we're very happily using all of them!
Re: Wanna know what product your competitor is working on? Try Slack
#67Re: Wanna know what product your competitor is working on? Try Slack
#68This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't. It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.
This is hardly an exploit. Since no authentication is required in order to see the chatroom listings for any domain, we must assume that they meant for their chatroom directory to be public information. This may not be what their customers are expecting, though...
It's not listing chatrooms, it's listing teams. Very different. For example, at the company I work we have two teams on Slack: Engineering and Marketing. Not really a problem if people find out that! The channel listing would potentially be more interesting, and this exploit does not allow you to see that (spoilers: it's "general", "random", and "cats").
Re: Wanna know what product your competitor is working on? Try Slack
#69Earlier quoted context omitted.
And this is why you should silo customer domains from internal domains as github did (smartly)!
Facebook might have a directory of employees, ldap or something. Too bad slack doesn't support any of this. This is the price they have to pay for reinventing username and password authentication and requiring everyone to register. It is also bad since employees quit or are fired, and you don't want to have to maintain a directory of employees on every application you use. Shameless plug, I work for https://auth0.com…
In their defence, Slack does have that as a "coming soon" for their enterprise version.
Re: Wanna know what product your competitor is working on? Try Slack
#70I haven't tried the hack, but it's something that had occurred to me for a while. We're using Slack internally and I've been wanting to get everyone in our larger organization to use it. Anyone with an email using our domain would be able to join. Which is ok with me. The only real flaw here is showing which groups are available (many of which can be client names or project names or product names that have yet to be…
Private channels could help with this. I believe they aren't visible unless you're explicitly invited.
This doesn't list channels at all, private or public, it only lists teams.