Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

411–420 of 526 posts

Re: Slack was hacked

#411

Post by homakov »

tracker1 wrote: post #101
geofft wrote: post #43

Earlier quoted context omitted.

Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/…

To you last point... it's funny the number of companies that are using virtual 2fa clients on their laptops for VPN connections because they wanted to save money on hardware tokens. kind of negates the second half of 2fa.

It doesn't. The only case when it's worse is when your laptop is stolen and you don't know about that - very unlikely for corporate laptops

Re: Slack was hacked

#413

Post by homakov »

larsiusprime wrote: post #39
larsiusprime wrote: post #6

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

While I appreciate all the downvotes and "get with the times" comments, a significant portion of the population does not have a smartphone, assuming everyone has a smartphone or will instantly know what to do when presented with official instructions that only mention smartphones/tablets seems like a bit of a security oversight on Slack's part, no? Those pointing out PC-enabled authentication apps: thanks. That's USE…

It's totally fine to use web based otp generator. Don't listen to others, you don't need a smartphone.

Re: Slack was hacked

#414

Post by ghshephard »

FiloSottile wrote: post #130

I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database. https://blog.filippo.io/salt-and-pepper/ tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce. It's simpl…

If you care about security then just use an HSM, they aren't that expensive, and eliminate the possibility of a database dump.

Re: Slack was hacked

#415

Post by archinal »

gravity13 wrote: post #373
jbob2000 wrote: post #88

Earlier quoted context omitted.

It fills a necessary gap on large and remote teams. Email is too cumbersome, verbal communication isn't always practical or possible, nothing does group chats very well.

And it's not hipchat (or bought by Atlassian). Let's not forget that.

Can I ask why that would be a problem? You can actually host HipChat yourself (behind your own firewall), which seems like a great asset against this kind of breach.

Re: Slack was hacked

#416

Post by mbrubeck »

Someone1234 wrote: post #348
pc86 wrote: post #268

Earlier quoted context omitted.

By not implementing the suggestion, presumably. This is rolling your own crypto, which is universally bad. To paraphrase Bruce Schneier, anyone can write a crypto algorithm they themselves can't break. Peppering a password hash destroys any future maintainability.

By that logic, every extra character you concat onto a salt is also "rolling your own crypto." For example if my salt was CrytoRandom(10), and you increase it to CrytoRandom(15) you've just "rolled your own crypto" according to you. If that is not the case then explain the difference between CryptoRandom(15) and CrytoRandom(10) + CryptoRandom(5) (longer salt Vs. salt+pepper). There's a lot of people spreading FUD ("i…

PBKDFs like bcrypt assume the salt is a random value that is not re-used and is not required to be secret. You are re-using part of it, and require that it is secret. That's the worrying part, and it's one of the reasons that several concrete proposals posted here have actual security flaws.

Re: Slack was hacked

#417

Post by cjbarber »

[deleted] wrote: post #393

[deleted]

Did you read the blog post?

The first paragraph concludes with:

> We have also released two factor authentication and we strongly encourage all users to enable this security feature.

Also, the title of the post is:

> March 2015 Security Incident and the Launch of Two Factor Authentication

They are not pending 2FA anymore.

Re: Slack was hacked

#418

Post by MichaelGG »

Someone1234 wrote: post #327
rnovak wrote: post #299

Earlier quoted context omitted.

Once you use Encryption, it's no longer pepper, it's encryption with weak key storage (hard-coded). At that point, genuinely, why not just follow best practices and store the key securely (e.g. using an HSM)?

Because nobody knows how to do that and it is likely extremely expensive by every metric. And, no, I am not being facetious by saying nobody knows how to do that. I am being quite literal. Have you ever done that? Do you know how? Do you even know what you would google to figure out how? I'm yet to see my favorite library of course's documentation on a HSM. How do you do that in e.g. PHP with MySQL? MVC with MS SQL?…

Eh, I had a Luna CA3 sitting on my desk for a while. HSMs aren't that exotic. I'd be more concerned about the HA aspects which could require extra code. I suppose you could just shove a USB HSM in several of your servers and encrypt every password with at least 2 of them.

Re: Slack was hacked

#419

Post by hsshah »

cjbarber wrote: post #417
[deleted] wrote: post #393

[deleted]

Did you read the blog post? The first paragraph concludes with: > We have also released two factor authentication and we strongly encourage all users to enable this security feature. Also, the title of the post is: > March 2015 Security Incident and the Launch of Two Factor Authentication They are not pending 2FA anymore.

I just enabled it with Google Authenticator. And tried using on my phone. Didn't seem to work. May be they are getting DDoS right now due to the announcement.

Re: Slack was hacked

#420

Post by flurdy »

danielsamuels wrote: post #383
cheshire137 wrote: post #151

Looks like they require Google Authenticator or Duo Mobile app to do two-factor auth. I'm not interested. Why can't they be like Github and just send me a text message? I don't want a dependency on some other company's product to make Slack more secure.

You can use other apps such as Authy too.

Wish Clef would integrate with Google Authenticator, https://getclef.com/

Feels like a much nicer way to provide the "something I have" part of authentication.

Post reply on HN