Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

81–90 of 526 posts

Re: Slack was hacked

#81

Post by superuser2 »

kendallpark wrote: post #20
rudolf0 wrote: post #2

It's refreshing to 1) see a breach notification including the actual password hashing algorithm, 2) see they're using a strong one like bcrypt (presumably with a reasonable cost factor). Regardless, this is an example of why cloud communication (and ticketing and database off-loading [see MongoHQ] and...) systems probably won't ever become commonplace in most of the government space and the finance and health sectors…

> Regardless, this is an example of why cloud communication (and ticketing and database off-loading [see MongoHQ] and...) systems probably won't ever become commonplace in most of the government space and the finance and health sectors. I agree. We might not like rolling out our own instances, but it prevents hackers from being able to grab ALL THE DATA in one fell swoop. It really amazes me that some EHR systems hav…

It's heartening to me. I've seen small practices with atrocious IT security. No WAY is self-hosted (for the thousands of small practices with maybe a couple of clueless help-desk types) even a billionth as secure as a professionally secured cloud service.

Also, "cloud" for services like this means "your own private instance of the software running in a private VM in our datacenter" not "your own customer_id in a shared database."

Re: Slack was hacked

#82

Post by Xylakant »

sarciszewski wrote: post #27
nvk wrote: post #19

Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!

Not sure why this is being downvoted. Setting up IRC on a .onion isn't even difficult. Setting it up with SSL is only a touch harder.

SSL does not protect against a variety of attacks, among them:

* breach via a compromised (guessed) password * breach via a security issue in the service and/or the host

Hosting your own service may make sense depending on your knowledge and/or threat model, but it's not a silver bullet that solves all issues. Hosting on a .onion address buys you exactly nothing in terms of security - and in the case of a company/team chat server probably not even in terms of privacy.

Re: Slack was hacked

#83

Post by laumars »

ipedrazas wrote: post #53
fillskills wrote: post #10

Earlier quoted context omitted.

My concern are the usernames, emails and phone numbers that were probably not encrypted

Exactly!!! Encrypting user data should be a common practice like hashing passwords.

Why? Encrypting e-mail addresses would break password reset features and phone numbers are generally public anyway (yes you can go X-directory, but the real issue here is why these services require a valid phone number to begin with)

Re: Slack was hacked

#84

Post by programmarchy »

3princip wrote: post #54

Lot's of hype (IMO) around Slack, but lot's of money thrown at them so I kept thinking that I'm missing something! Just being skeptical as usual. The other day an invitation arrives to use Slack. Great! Let's see it, this killer feature or killer combination of features. What have these smart people come up with that hasn't been done countless times in the same space to make them so successful? It's literally nothing…

I think a key differentiation with Slack is their design, and that they provide clients for both mobile, web and desktop. I can't think of another product that has done this well.

Re: Slack was hacked

#85

Post by aidos »

3princip wrote: post #54

Lot's of hype (IMO) around Slack, but lot's of money thrown at them so I kept thinking that I'm missing something! Just being skeptical as usual. The other day an invitation arrives to use Slack. Great! Let's see it, this killer feature or killer combination of features. What have these smart people come up with that hasn't been done countless times in the same space to make them so successful? It's literally nothing…

I would say that their ux is actually really good. I'd go so far as to say they have one of the best on boarding experiences I've ever seen. But that's just my opinion.

Re: Slack was hacked

#86

Post by tracker1 »

petercooper wrote: post #47
sarciszewski wrote: post #27

Earlier quoted context omitted.

Not sure why this is being downvoted. Setting up IRC on a .onion isn't even difficult. Setting it up with SSL is only a touch harder.

Setting up an ircd is not a bad idea. Then we just need to find the ircd and client that does what Slack does. (Which is totally possible, but I'm not sure it exists?)

Slack also has webhooks/bots that interact with other services for notifications... pingdom, github, etc... which can be done with bots, but it gets more complicated. Not to mention search archives, file upload preservation and other display niceties.

Re: Slack was hacked

#87

Post by nvk »

blfr wrote: post #74
nvk wrote: post #19

Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!

It will take you more than 10 minutes to just choose the ircd to use. Not to mention configuration and maintenance. I looked through the ircds available in Debian repositories the other day and they didn't look very fresh. So you might also have to package them from source and make sure that stays up to date. Hosting your own services has some appealing security qualities (like being able to put them in your VPN) but…

Saved you the search; ngircd

Re: Slack was hacked

#88

Post by jbob2000 »

3princip wrote: post #54

Lot's of hype (IMO) around Slack, but lot's of money thrown at them so I kept thinking that I'm missing something! Just being skeptical as usual. The other day an invitation arrives to use Slack. Great! Let's see it, this killer feature or killer combination of features. What have these smart people come up with that hasn't been done countless times in the same space to make them so successful? It's literally nothing…

It fills a necessary gap on large and remote teams. Email is too cumbersome, verbal communication isn't always practical or possible, nothing does group chats very well.

Re: Slack was hacked

#90

Post by tracker1 »

chrisfosterelli wrote: post #26
eranation wrote: post #12

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. I'm happy to hear they didn't just use MD5 with no salt as this would be the same as storing it in plane text... bcrypt + random salt sounds to me like the best practice nowadays, is it still holding? or are there some advanced in GPU cl…

Well, bcrypt + random salt is great but it still can't protect you from bad passwords. It's vulnerable to a dictionary or bruteforce attack the same way everything else is. You _can_ increase the difficulty of bcrypt, which essentially increases the iterations (as you mentioned). Most bcrypt libraries default this value, but the programmer can override it. The downside is that this requires you to update all of your…

Note: if your hashing algorithm is too compute intensive, you have to take other measures to prevent your login system from being a DDOS vector... for example, with SCrypt's recommended defaults for passwords, the .Net library takes almost half a second of time on a modern CPU... if you get more than a few dozen requests per second, per system you can be brought to a crawl without other mitigation in place.
Post reply on HN