[deleted]
They go into details about this in the post. It's bcrypt with a salt.
I shudder to imagine anyone bothering to build bcrypt WITHOUT a salt. In general, salt is implied in bcrypt.
Slack was hacked
21–30 of 526 posts
Re: Slack was hacked
#22Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
If security is that important to you, buy one. A cheap Android tablet isn't exactly going to break the bank, is it?
Re: Slack was hacked
#23> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
The post notes that the breached database is the user table, which would not contain chat history. I agree that making this abundantly clear makes sense.
This makes it sound like other data was compromised for some specific users. Since they didn't go into how they know it was only for only these users, I'm not very confident about this.
> As part of our investigation we detected suspicious activity affecting a very small number of Slack accounts. We have notified the individual users and team owners who we believe were impacted and are sharing details with their security teams. Unless you have been contacted by us directly about a password reset or been advised of suspicious activity in your team’s account, all the information you need is in this blog post.
Re: Slack was hacked
#24Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
Get an OTP app for your laptop. It's an open standard.
Re: Slack was hacked
#25Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
These usually fall back to regular text messages.
Re: Slack was hacked
#26> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. I'm happy to hear they didn't just use MD5 with no salt as this would be the same as storing it in plane text... bcrypt + random salt sounds to me like the best practice nowadays, is it still holding? or are there some advanced in GPU cl…
Well, bcrypt + random salt is great but it still can't protect you from bad passwords. It's vulnerable to a dictionary or bruteforce attack the same way everything else is.
You _can_ increase the difficulty of bcrypt, which essentially increases the iterations (as you mentioned). Most bcrypt libraries default this value, but the programmer can override it. The downside is that this requires you to update all of your hashes, which limits how often this is done.
Re: Slack was hacked
#27Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!
Not sure why this is being downvoted. Setting up IRC on a .onion isn't even difficult. Setting it up with SSL is only a touch harder.
Re: Slack was hacked
#28Earlier quoted context omitted.
Agreed. The content of the chat's would be potentially much more important in my mind.
Which leads to the question if slack encrypts the chat data in the database.
That would make implementing search quite hard so I'd say - it's pretty likely they don't encrypt it.
Re: Slack was hacked
#29I wonder how many people send sensitive credentials or other operational details through Slack. It'd definitely be a target (along with mail systems) if you want to attack better-protected customer systems.
Re: Slack was hacked
#30Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?