How many rounds of hashing did they use?
Slack was hacked
181–190 of 526 posts
Re: Slack was hacked
#182I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…
Is there any significant evidence that peppering passwords helps? I've seen arguments for and against peppering out on the big bad internet. Everyone has opinions but there are few people's opinions about crypto that I actually trust.
The best article I've seen against this technique is by ircmaxell [0]. Nicely summed up in this sentence "It is far better to use standard, proven algorithms then to create your own to incorporate a pepper."
Anyone have source material (academic paper, Bruce "The Crypto God" Schneier blog post) that shreds some light on peppering passwords?
I'd be much more interested in how many iterations of bcryprt Slack were using. That has a much bigger bearing on events for me. Anyone at Slack know/want to answer that question?
[0] http://blog.ircmaxell.com/2012/04/properly-salting-passwords...
Re: Slack was hacked
#183Re: Slack was hacked
#184I wonder how many people send sensitive credentials or other operational details through Slack. It'd definitely be a target (along with mail systems) if you want to attack better-protected customer systems.
I think that's the point of slack, being able to communicate sensitive information. Where would you relay something like an Amazon AWS Access Key?
Re: Slack was hacked
#185Why do I have to install Google Authenticator some sort of other app for 2factor here? Why can't you send me a text like everyone else does? EDIT: Slack responded that they do not support SMS yet .
That's my big complaint, too. Just do like Github and send me a text message. I don't want some additional company's app as a dependency.
Re: Slack was hacked
#186I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…
Please do not do it: http://stackoverflow.com/questions/16891729/best-practices-s...
so the downsides are "it's not maintanable" and "don't roll your own crypto". I think they are negligible compared to the upsides.
Re: Slack was hacked
#187Earlier quoted context omitted.
bcrypt is only strong if their cost / work-factor is set correctly
The default cost for most libraries and languages is between 10 and 12, which is considered too low for 2015 but still pretty good. As long as they're at the default or above it, I wouldn't be too concerned about an attack against the whole DB. Targeted cracking attempts against specific hashes are definitely still an issue though.
Considered to low by...?
Re: Slack was hacked
#188Earlier quoted context omitted.
Agreed. The content of the chat's would be potentially much more important in my mind.
Which leads to the question if slack encrypts the chat data in the database.
Is there a good reason to keep chat data longer than it takes to deliver it to the recipient?
Re: Slack was hacked
#189Wait a second, you got hacked 27 DAYS ago (at least), you know they got data, and you are NOW telling people? Dong, Dong, Dong, that is the death bell of a startup
It could be a bad idea to let intruders know you're on to them if you haven't determined the extent of the intrusion.
Re: Slack was hacked
#190> No financial or payment information was accessed or compromised in this attack. This wouldn't be my first concern. It would be all of the confidential communication that happens within slack.
My concern are the usernames, emails and phone numbers that were probably not encrypted
What useful information do I gain by exfiltrating a DB that says fillskills@slack signed up with fillskills@outlook.com and can be contacted at 867-5309?