Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

11–20 of 526 posts

Re: Slack was hacked

#11

Post by hazelnut »

jxm262 wrote: post #5
bitsweet wrote: post #3

> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.

Agreed. The content of the chat's would be potentially much more important in my mind.

Which leads to the question if slack encrypts the chat data in the database.

Re: Slack was hacked

#12

Post by eranation »

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form.

I'm happy to hear they didn't just use MD5 with no salt as this would be the same as storing it in plane text...

bcrypt + random salt sounds to me like the best practice nowadays, is it still holding? or are there some advanced in GPU cluster costs on EC2 that make even bcrypt hackable. I think I heard something that it has a way to "adapt" to advances in computing, is that by simply adding more iterations based on the current CPU speed or something? how does that work?

Re: Slack was hacked

#13

Post by ForHackernews »

[deleted] wrote: post #9

[deleted]

FTFA:

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form.

Re: Slack was hacked

#14

Post by ocdtrekkie »

larsiusprime wrote: post #6

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

Slack is from the startup culture. Do not expect any support for people who are not "up with the times" and crud.

Re: Slack was hacked

#15

Post by jscottmiller »

[deleted] wrote: post #9

[deleted]

The article indicates that bcrypt was used.

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form.

Re: Slack was hacked

#17

Post by hazelnut »

[deleted] wrote: post #9

[deleted]

"Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form."

Re: Slack was hacked

#19

Post by nvk »

Host your own IRC if you care about the privacy and security of your communication.

There is no reason why you can't take 10min to setup a IRC with SSL on your own.

Yes, Slack is awesome, lots of features, but it's not yours!

Re: Slack was hacked

#20

Post by kendallpark »

rudolf0 wrote: post #2

It's refreshing to 1) see a breach notification including the actual password hashing algorithm, 2) see they're using a strong one like bcrypt (presumably with a reasonable cost factor). Regardless, this is an example of why cloud communication (and ticketing and database off-loading [see MongoHQ] and...) systems probably won't ever become commonplace in most of the government space and the finance and health sectors…

> Regardless, this is an example of why cloud communication (and ticketing and database off-loading [see MongoHQ] and...) systems probably won't ever become commonplace in most of the government space and the finance and health sectors.

I agree. We might not like rolling out our own instances, but it prevents hackers from being able to grab ALL THE DATA in one fell swoop. It really amazes me that some EHR systems have gone the cloud route.

Post reply on HN