Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

161–170 of 526 posts

Re: Slack was hacked

#161

Post by asenchi »

nvk wrote: post #94
tracker1 wrote: post #86

Earlier quoted context omitted.

Slack also has webhooks/bots that interact with other services for notifications... pingdom, github, etc... which can be done with bots, but it gets more complicated. Not to mention search archives, file upload preservation and other display niceties.

I don't personally use it, but this might help your https://hubot.github.com/

Careful, that has basically zero in the way of authorization/authentication. Putting business logic in there on a standard deploy is asking for trouble, especially if malicious accounts have access.

Re: Slack was hacked

#162

Post by orthecreedence »

programmarchy wrote: post #36
nvk wrote: post #19

Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!

Agree with you in one sense of being responsible for your own security, but by this logic I should keep all my money under the mattress instead of the bank, no?

> but by this logic I should keep all my money under the mattress instead of the bank, no?

More like "by this logic I should keep all my money under the mattress instead of in a jar in my cousin's pantry, no?"

Slack isn't a secure vault for data, it's a communications tool. They obviously have some amount of security but that's not their purpose, whereas a bank is intended to store money.

I think running your own IRC is a perfectly acceptable solution if you value your data.

Re: Slack was hacked

#163

Post by VBprogrammer »

StavrosK wrote: post #67
omgitstom wrote: post #51

Earlier quoted context omitted.

bcrypt is only strong if their cost / work-factor is set correctly

Exactly this. If they used ten rounds, it's dire, and just saying "bcrypt" doesn't say much unless you also specify the number of rounds.

It says a lot more than your passwords are safely stored behind unsalted MD5 :)

Re: Slack was hacked

#164

Post by santosha »

scrollaway wrote: post #125
ipedrazas wrote: post #53

Earlier quoted context omitted.

Exactly!!! Encrypting user data should be a common practice like hashing passwords.

Third party authentication should be the norm. Leaving authentication to providers that absolutely know their shit , just like we leave payments to third party services. Of course, that requires a decent protocol, and Mozilla is doing the world a disservice in not marketing Persona better seeing as it's the right solution....

Major privacy issues, single point of failure etc etc. We leave payments to third party services because nobody wants to deal with the compliance nightmare that PCI-DSS is, not for security reasons. Payment is also mostly less sensitive to availability and latency issues than authentication.

Re: Slack was hacked

#165

Post by scintill76 »

johannh wrote: post #91
3princip wrote: post #54

Lot's of hype (IMO) around Slack, but lot's of money thrown at them so I kept thinking that I'm missing something! Just being skeptical as usual. The other day an invitation arrives to use Slack. Great! Let's see it, this killer feature or killer combination of features. What have these smart people come up with that hasn't been done countless times in the same space to make them so successful? It's literally nothing…

https://en.wikipedia.org/wiki/Egg_of_Columbus

Neat story, but I don't see the analogy. OP says he/she doesn't see any innovation, not "this innovation is obvious". At least tell us an egg or two that Slack cleverly stands on end.

Re: Slack was hacked

#167

Post by willismichael »

randunel wrote: post #153
FiloSottile wrote: post #130

I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…

I generally disagree with hardcoded salts, you should assume everything is compromised in a successful attack. But I'm actually commenting here because I don't see how you can retroactively apply the second salt to a hashed string. Could you please elaborate or share a link? Later edit: I'm referring to your example in your link: salt = urandom(16) pepper = "oFMLjbFr2Bb3XR)aKKst@kBF}tHD9q" # or, getenv('PEPPER') hash…

You append the salt to the hash, and then re-hash it. Not exactly pretty, but it works.

Re: Slack was hacked

#168

Post by andrewchilds »

dmazin wrote: post #134

Why do I have to install Google Authenticator some sort of other app for 2factor here? Why can't you send me a text like everyone else does? EDIT: Slack responded that they do not support SMS yet .

Because you can't trust SMS-based two-factor authentication.

http://en.wikipedia.org/wiki/Multi-factor_authentication#SMS...

http://webcache.googleusercontent.com/search?q=cache:UiwfUal...

Re: Slack was hacked

#169

Post by [deleted] »

FiloSottile wrote: post #130

I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…

[deleted]

Re: Slack was hacked

#170

Post by stiff »

FiloSottile wrote: post #130

I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…

Please do not do it:

http://stackoverflow.com/questions/16891729/best-practices-s...

Post reply on HN