Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

341–350 of 526 posts

Re: Slack was hacked

#341

Post by dhfromkorea »

mike_hearn wrote: post #176
scrollaway wrote: post #125

Earlier quoted context omitted.

Third party authentication should be the norm. Leaving authentication to providers that absolutely know their shit , just like we leave payments to third party services. Of course, that requires a decent protocol, and Mozilla is doing the world a disservice in not marketing Persona better seeing as it's the right solution....

You mean like how Authy specialised in two-factor authentication, but still managed to have basic string concatenation bugs that rendered their entire 2FA system bypassable?

hey, that causes some immediate stir in my mind as a user of Authy. Could you share any reference to the incident you mentioned?

Re: Slack was hacked

#342

Post by gaadd33 »

LaurentVB wrote: post #243
jacquesm wrote: post #204

Earlier quoted context omitted.

That alone would be a great reason not to use them.

It's also a great reason to use them, isn't it? Your searchable chat history basically becomes the knowledge base of your company.

And a great target for discovery in any sort of lawsuit.

Re: Slack was hacked

#343

Post by BrainInAJar »

dragonwriter wrote: post #317
BrainInAJar wrote: post #305

Earlier quoted context omitted.

> Because SMS is not even remotely a secure communication channel Neither is 2FA, it's a key stored completely unencrypted in both your phone and the the host's db.

That's not particularly weak as proof to the person who controls the DB that you have access to the phone, which is what the device factor of a 2FA scheme is intended to prove, since you have to have access to either the DB or the phone to get the key. Conversely, SMS's weakness is in the communication channel, which can be compromised without compromising the things for which the factor is intended as proof.

Phones get hacked too. If you ever access a site with your phone, it's not two factor auth. Malware can read your 2FA key and read your password as you type it in.

Re: Slack was hacked

#344

Post by CameronBanga »

Sami_Lehtinen wrote: post #260
FiloSottile wrote: post #130

I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…

I still wonder what value does password leak have. I changed my password, my old password was: DV1wn3yHk6W-8m9lZNo_ now you all know it, so what? I don't care, I believe you don't care either. On the other hand, if they were after valuable data, they had access to database and the got what they wanted. So the password is much less valuable than the other stuff they might have wanted. Like chat logs which might contai…

Because I'm sure everyone uses a long, complex, and unique password on Slack. So nothing to worry about, everyone.

Re: Slack was hacked

#345

Post by vram22 »

Got the email from them about the issue, as a Slack user. Also got 2 other duplicate emails from them (which went into the same Gmail conversation, since same subject), that were empty.

Seen this a few times for other services, not sure why it happens.

Re: Slack was hacked

#346

Post by vram22 »

Got the email from them about the issue, as a Slack user. Also got 2 other duplicate emails from them (which went into the same Gmail conversation, since same subject), that were empty.

Seen this a few times for other services, not sure why it happens.

Re: Slack was hacked

#347

Post by fxthea »

vram22 wrote: post #345

Got the email from them about the issue, as a Slack user. Also got 2 other duplicate emails from them (which went into the same Gmail conversation, since same subject), that were empty. Seen this a few times for other services, not sure why it happens.

They probably send a message to you for every team you're on.

Re: Slack was hacked

#348

Post by Someone1234 »

pc86 wrote: post #268
scott_karana wrote: post #146

Earlier quoted context omitted.

I don't see that as a negative suggestion: that's a fantastic idea, and for all we know, a Slack employee will read your post, and make their hashing even better. :-)

By not implementing the suggestion, presumably. This is rolling your own crypto, which is universally bad. To paraphrase Bruce Schneier, anyone can write a crypto algorithm they themselves can't break. Peppering a password hash destroys any future maintainability.

By that logic, every extra character you concat onto a salt is also "rolling your own crypto."

For example if my salt was CrytoRandom(10), and you increase it to CrytoRandom(15) you've just "rolled your own crypto" according to you.

If that is not the case then explain the difference between CryptoRandom(15) and CrytoRandom(10) + CryptoRandom(5) (longer salt Vs. salt+pepper).

There's a lot of people spreading FUD ("it is unknown!!!") and nonsense (concat two strings is literally rolling your own crypto!) in this thread.

I don't know if peppers are worth the dev' time, deployment issues, and additional maintenance (e.g. rotation). However I do know that the people arguing against it here aren't making rational counter-arguments that hold up under basic scrutiny.

Re: Slack was hacked

#349

Post by koide »

asenchi wrote: post #161
nvk wrote: post #94

Earlier quoted context omitted.

I don't personally use it, but this might help your https://hubot.github.com/

Careful, that has basically zero in the way of authorization/authentication. Putting business logic in there on a standard deploy is asking for trouble, especially if malicious accounts have access.

I use ejabberd as chat server and as interface to hubot. Solves both authentication and backlog issues. With a ssh tunnel (or your choice of vpn), it also solves out of network access. Jabber and ssh clients exist for Android (and iOS I presume)

Re: Slack was hacked

#350

Post by curiously »

mastermojo wrote: post #238
curiously wrote: post #92

is there anything that slack does you can't do with skype? I find lot of these new startups are just creative ways of reinventing the wheel and convincing you need it to appear cool & hip....kind of like fashion for high schoolers

skype doesn't have admin/team lead functions that companies typically might want. my skype mobile app crashes all the time. also inline gifs are cool.

could be a bad phone. my skype mobile app used to crash all the time but I switched to a faster Android phone and its smooth.
Post reply on HN