31–40 of 526 posts
Is this true even when the attacker is specifically focusing on a single account, or is it only computationally infeasible to recover passwords for accounts in general?
Literally was arguing with someone like two days ago that using Slack for sensitive data was a bad idea, guaranteed to blow up in your face sooner or later. Nothing sweeter than "I told you so".
Assuming the password hashes can't be reasonably reversed, what would have caused suspicious activity on some user accounts? Is this a situation where certain users may have been targeted specifically, meaning that only a couple hashes needed to be reversed, making the task feasible?
> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
My concern are the usernames, emails and phone numbers that were probably not encrypted
Earlier quoted context omitted.
The post notes that the breached database is the user table, which would not contain chat history. I agree that making this abundantly clear makes sense.
This makes it sound like other data was compromised for some specific users. Since they didn't go into how they know it was only for only these users, I'm not very confident about this. > As part of our investigation we detected suspicious activity affecting a very small number of Slack accounts. We have notified the individual users and team owners who we believe were impacted and are sharing details with their secu…
Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!
Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. I'm happy to hear they didn't just use MD5 with no salt as this would be the same as storing it in plane text... bcrypt + random salt sounds to me like the best practice nowadays, is it still holding? or are there some advanced in GPU cl…
Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
Those pointing out PC-enabled authentication apps: thanks. That's USEFUL feedback!
Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!
Agree with you in one sense of being responsible for your own security, but by this logic I should keep all my money under the mattress instead of the bank, no?