Metadata collection at it's finest!
Seriously this is very interesting and could be valuable. Expect that it will get fixed soon though.
Wanna know what product your competitor is working on? Try Slack
121–130 of 145 posts
Re: Wanna know what product your competitor is working on? Try Slack
#122Re: Wanna know what product your competitor is working on? Try Slack
#123Sorry that the site was down for long. The site was on poorman's hosting (hostgator) that could not take HN traffic and bogged down. Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now. Regarding not having disclosed this one discretely to Slack: * I have considerable experience in a couple opensource projects including Drupal and have reported mu…
[deleted]
Re: Wanna know what product your competitor is working on? Try Slack
#124My response to all the people who says it is nothing just the team names Check this screenshot of google teams http://m.imgur.com/a/eWLEf . There is a team name called viber and google doesn't own viber. Check this news that came 2 days back: http://www.jbgnews.com/2014/10/google-looking-to-rival-whats... Connect the dots. You can infer a lot. It is information disclosure at the finest. Smart thing is to accept it is…
How is this the fault of companies using Slack? That's nothing more than victim-blaming.
Victim-blaming? This isn't an assault or a crime, it's a shortcoming of the service. It falls well under the umbrella of "caveat emptor".
Re: Wanna know what product your competitor is working on? Try Slack
#125Sorry that the site was down for long. The site was on poorman's hosting (hostgator) that could not take HN traffic and bogged down. Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now. Regarding not having disclosed this one discretely to Slack: * I have considerable experience in a couple opensource projects including Drupal and have reported mu…
I also want to add on that I do not view this as a security issue. There are a myriad of things that should be done:
1) Your company should not be using SaaS services for sensitive projects w/o codenames. (Codename FishSauce = Viber M&A) -- obviously just obscurity, but still solid opsec.
2) I'd love to see your write-up on HipChat uploading all files directly to an S3 bucket accessible to the world.
3) Every user w/ that companies domain sees this each time they sign-in.
4)I just think it's overhyped and not a big deal.
5) It only impacts companies who have multiple slack TEAMS (not the same thing as channels, no channel names are disclosed)
Also, this is a decision Slack admins make: http://imgur.com/FCUE1mY
Re: Wanna know what product your competitor is working on? Try Slack
#126Earlier quoted context omitted.
This is hardly an exploit. Since no authentication is required in order to see the chatroom listings for any domain, we must assume that they meant for their chatroom directory to be public information. This may not be what their customers are expecting, though...
It's information disclosure at its finest. Something you _really_ want to avoid in a sensitive environment - which company internal comms certainly is.
It's a minor degree of information disclosure -- hardly at it's finest.
Re: Wanna know what product your competitor is working on? Try Slack
#127So this is just IRC with lipstick it didn't need?
Talk about reinventing the wheel.
Re: Wanna know what product your competitor is working on? Try Slack
#128Sorry that the site was down for long. The site was on poorman's hosting (hostgator) that could not take HN traffic and bogged down. Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now. Regarding not having disclosed this one discretely to Slack: * I have considerable experience in a couple opensource projects including Drupal and have reported mu…
[deleted]
As far as I know, the teams the user has already joined will also show in that listing, not just the ones they are authorized to join. Even with the auto-auth setting turned off, then, anyone can get a listing of the teams to which a known email address already belongs.
Re: Wanna know what product your competitor is working on? Try Slack
#129Earlier quoted context omitted.
By using slack or any other external chat system, you're leaking metadata and comms content.
Leaking to where? By using the internet you're leaking [meta]data. It's a question of degrees and trust.
They are leaking potentially confidential information to a third party company running the service, in this case Slack. For all you know they could be doing stock trades based on all the insider info they can glean from their chat traffic as their business model.
If the communication includes material insider information, like companies/products they are considering buying, and they are flinging it all over the internet so third parties can read and act on it the SEC can charge them.
If you use cloud services for company communication then you at least need to have provably secure encryption so only the people you want to see the conversation can.
Of course this criticism applies to all the suckers who use Google and Microsoft cloud services for their business.
Re: Wanna know what product your competitor is working on? Try Slack
#130Slack has a setting that allows anyone with an email address in your domain name to join without being invited. I imagine if you turn that setting off, this problem goes away.