Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#101

Post by penagwin »

weinzierl wrote: post #99
jedberg wrote: post #94

I live by the following hierarchy: - Anything written down and transmitted digitally will be available to anyone who wants it eventually. Besides my copy, the recipient has a copy, as do any number of intermediaries. Encrypted or not, that encryption will almost certainly be broken in my lifetime. - Anything written down on physical medium or stored digitally (but not transmitted) will be freely available to anyone t…

> - Anything written down [..] > - Anything I say to someone [..] In my hierarchy these two points are swapped. At least I think there is a real chance to keep written material secret as long as you are not a target of a state level adversary. I can write in a room where I am sure there are no cameras watching and I can put my copy in a safe where I would know if it was compromised. On the other hand I can almost nev…

I had a similar comment.

We're increasingly surrounded by microphones/cameras, some of which are embedded in IOT or other appliances.

Given the NSA's track record, the risk of devices getting hacked, etc. I've become rather conscious of potential implications they could have.

Re: What If All Your Slack Chats Were Leaked?

#102

Post by ecnahc515 »

AceyMan wrote: post #82
jeremyjh wrote: post #33

Earlier quoted context omitted.

I’d guess the number of times a password has been shared in a private channel/direct message is a number with quite a lot of 0s behind it.

fwiw, when I have to share a password or api key in a DM once the party acks receipt I then delete the message. Unless a snapshot is taken in the interval I reason that there won't be a persistent copy left behind. Does anyone 'behind-the-curtain' know anything that would contradict my assumptions?

Those messages are certainly not deleted in the backend. They can be read by your organization's slack admins even.

Re: What If All Your Slack Chats Were Leaked?

#103

Post by Wowfunhappy »

ecnahc515 wrote: post #102
AceyMan wrote: post #82

Earlier quoted context omitted.

fwiw, when I have to share a password or api key in a DM once the party acks receipt I then delete the message. Unless a snapshot is taken in the interval I reason that there won't be a persistent copy left behind. Does anyone 'behind-the-curtain' know anything that would contradict my assumptions?

Those messages are certainly not deleted in the backend. They can be read by your organization's slack admins even.

Wow.

This should be considered harmful, due to exactly the scenario described by the GP! Perhaps it's true that tokens and such should not be shared on a channel like Slack to begin with, but it's also very reasonable to assume that deleted messages actually get deleted, at least absent a data forensics expert or similar.

Re: What If All Your Slack Chats Were Leaked?

#104

Post by jedberg »

weinzierl wrote: post #99
jedberg wrote: post #94

I live by the following hierarchy: - Anything written down and transmitted digitally will be available to anyone who wants it eventually. Besides my copy, the recipient has a copy, as do any number of intermediaries. Encrypted or not, that encryption will almost certainly be broken in my lifetime. - Anything written down on physical medium or stored digitally (but not transmitted) will be freely available to anyone t…

> - Anything written down [..] > - Anything I say to someone [..] In my hierarchy these two points are swapped. At least I think there is a real chance to keep written material secret as long as you are not a target of a state level adversary. I can write in a room where I am sure there are no cameras watching and I can put my copy in a safe where I would know if it was compromised. On the other hand I can almost nev…

It's true, those two may soon swap, as my trust in not being recorded goes down.

Re: What If All Your Slack Chats Were Leaked?

#105

Post by [deleted] »

jedberg wrote: post #94

I live by the following hierarchy: - Anything written down and transmitted digitally will be available to anyone who wants it eventually. Besides my copy, the recipient has a copy, as do any number of intermediaries. Encrypted or not, that encryption will almost certainly be broken in my lifetime. - Anything written down on physical medium or stored digitally (but not transmitted) will be freely available to anyone t…

[deleted]

Re: What If All Your Slack Chats Were Leaked?

#106

Post by ci5er »

Wowfunhappy wrote: post #103
ecnahc515 wrote: post #102

Earlier quoted context omitted.

Those messages are certainly not deleted in the backend. They can be read by your organization's slack admins even.

Wow. This should be considered harmful, due to exactly the scenario described by the GP! Perhaps it's true that tokens and such should not be shared on a channel like Slack to begin with, but it's also very reasonable to assume that deleted messages actually get deleted, at least absent a data forensics expert or similar.

Why would you assume that? I (as the 'designer' of a couple of distributed event-sourced systems), will create a message (as an event) that ricochets around to update several SQL and non-SQL systems that are normalized or denormalized views, or what not. When a 'delete' command (event) gets sent around, that gets accepted by subscribers/listeners, and they 'mark' their respective 'column' equivalents as 'deleted', but in an append-only log, the idea that a disk block gets updated is kind of nonsensical.

The logic goes: 1) something happened. 2) we regret it - please hide it from (most) quesry responses.

I know if I was dealing with an RDBMS, it's probably easy enough to delete it, but in an eventually consistent, heterogenous, append-only world, an actual delete-delete is kind of a hassle to even contemplate.

Re: What If All Your Slack Chats Were Leaked?

#107

Post by Wowfunhappy »

ci5er wrote: post #106
Wowfunhappy wrote: post #103

Earlier quoted context omitted.

Wow. This should be considered harmful, due to exactly the scenario described by the GP! Perhaps it's true that tokens and such should not be shared on a channel like Slack to begin with, but it's also very reasonable to assume that deleted messages actually get deleted, at least absent a data forensics expert or similar.

Why would you assume that? I (as the 'designer' of a couple of distributed event-sourced systems), will create a message (as an event) that ricochets around to update several SQL and non-SQL systems that are normalized or denormalized views, or what not. When a 'delete' command (event) gets sent around, that gets accepted by subscribers/listeners, and they 'mark' their respective 'column' equivalents as 'deleted', bu…

If it needs to exist in the raw database for technical reasons, that's one thing, but it shouldn't be visible to anyone including the administrator.

Re: What If All Your Slack Chats Were Leaked?

#109

Post by ci5er »

Wowfunhappy wrote: post #107
ci5er wrote: post #106

Earlier quoted context omitted.

Why would you assume that? I (as the 'designer' of a couple of distributed event-sourced systems), will create a message (as an event) that ricochets around to update several SQL and non-SQL systems that are normalized or denormalized views, or what not. When a 'delete' command (event) gets sent around, that gets accepted by subscribers/listeners, and they 'mark' their respective 'column' equivalents as 'deleted', bu…

If it needs to exist in the raw database for technical reasons, that's one thing, but it shouldn't be visible to anyone including the administrator.

If you mean the site-/team- administrator, that's probably right. (We have similar issues for HIPAA related reasons).

Our production emergency debuggers, there aren't many, get a bit more leeway than they probably should because they are trying to help us respond to failures under heavy SLA penalties. The 'these-people-ran-this-query' logs are immutable, and (hopefully) keep them in check from random lookups on their ex's during some dumpster fire exercise or another.

Re: What If All Your Slack Chats Were Leaked?

#110

Post by ForHackernews »

jedberg wrote: post #94

I live by the following hierarchy: - Anything written down and transmitted digitally will be available to anyone who wants it eventually. Besides my copy, the recipient has a copy, as do any number of intermediaries. Encrypted or not, that encryption will almost certainly be broken in my lifetime. - Anything written down on physical medium or stored digitally (but not transmitted) will be freely available to anyone t…

> or until someone invents adversarial brain scans

These are coming sooner than many people will be comfortable with: https://www.npr.org/templates/story/story.php?storyId=157448...

Post reply on HN