51–60 of 526 posts
It's refreshing to 1) see a breach notification including the actual password hashing algorithm, 2) see they're using a strong one like bcrypt (presumably with a reasonable cost factor). Regardless, this is an example of why cloud communication (and ticketing and database off-loading [see MongoHQ] and...) systems probably won't ever become commonplace in most of the government space and the finance and health sectors…
> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. Is this true even when the attacker is specifically focusing on a single account, or is it only computationally infeasible to recover passwords for accounts in general?
// this is about focusing on a single account. Nobody would ever bother with trying to crack the whole DB.
> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
My concern are the usernames, emails and phone numbers that were probably not encrypted
Encrypting user data should be a common practice like hashing passwords.
It's literally nothing. I can't believe that's the product.
Anyway, on top of a completely underwhelming experience comes this news. I can't see why a company would use them, to be honest. But then I haven't built a billion dollar company, so not many people will be asking me for an opinion.
Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?
While I appreciate all the downvotes and "get with the times" comments, a significant portion of the population does not have a smartphone, assuming everyone has a smartphone or will instantly know what to do when presented with official instructions that only mention smartphones/tablets seems like a bit of a security oversight on Slack's part, no? Those pointing out PC-enabled authentication apps: thanks. That's USE…
Earlier quoted context omitted.
Yes we do, keep millions for our customers too; Bitcoin company here. :)
Ah, in your case, only because your customers aren't smart enough to keep theirs under their own mattresses.
Big fan of customers having a way out and not have to trust the service provider.
> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. I'm happy to hear they didn't just use MD5 with no salt as this would be the same as storing it in plane text... bcrypt + random salt sounds to me like the best practice nowadays, is it still holding? or are there some advanced in GPU cl…
But I would say yes, bcrypt is still best practice. Other commenters are right that bad passwords will still be recoverable, but using one of bcrypt/scrypt/PBKDF2 is due diligence. I would use whichever one is most easily available on your platform.
> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. Is this true even when the attacker is specifically focusing on a single account, or is it only computationally infeasible to recover passwords for accounts in general?
> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
Under their FAQ on the post. It could be inferred that there was some unauthorized access to certain users' communication logs?
> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
The post notes that the breached database is the user table, which would not contain chat history. I agree that making this abundantly clear makes sense.
edit you can log in if and when you crack some of the hashes.