Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack was hacked

slackhq.com

Post reply on HN
Print view View original

101–110 of 526 posts

Re: Slack was hacked

#101

Post by tracker1 »

geofft wrote: post #43
larsiusprime wrote: post #6

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/…

To you last point... it's funny the number of companies that are using virtual 2fa clients on their laptops for VPN connections because they wanted to save money on hardware tokens. kind of negates the second half of 2fa.

Re: Slack was hacked

#102

Post by globaloptima »

globaloptima wrote: post #89

Out of interest, where where the per-user salts stored I wonder? Where would people normally store this if not next to the hashed password in the same table?

I'll answer my own question, given the attacker wouldn't know how the salt was used unless they had access to the code, it doesn't matter.

Re: Slack was hacked

#103

Post by ChicagoDave »

geofft wrote: post #43
larsiusprime wrote: post #6

Slack encourages 2-factor authentication: > Download and install either the Google Authenticator or Duo Mobile apps on your phone or tablet. Hey Slack, I don't have a smartphone. What am I supposed to do?

Lots of options. * You can buy a hardware token. https://www.duosecurity.com/product/methods/hardware-tokens * You can have Duo call/text you every time you want to log in. * You can use some other device you have that runs a mobile OS. I had Duo set up on my wifi-only iPad while I was using a feature phone for a few months a year ago. (I eventually gave up on that and got a smartphone, though.) * You can buy a used/…

I have a Nokia 1020 Windows Phone. There is a Duo app for it, but it's single account. Duo hasn't updated their WP app since 2012.

Re: Slack was hacked

#104

Post by mirashii »

Surprisingly, they didn't force a password reset on all accounts. Even though the passwords are hashed and salted, targeting a couple users and checking for weak passwords can now be done offline, with no rate-limiting or network calls necessary. In breaches like these, it should still be mandatory to issue service wide password resets. Anything less is unacceptable.

Re: Slack was hacked

#105

Post by [deleted] »

programmarchy wrote: post #36
nvk wrote: post #19

Host your own IRC if you care about the privacy and security of your communication. There is no reason why you can't take 10min to setup a IRC with SSL on your own. Yes, Slack is awesome, lots of features, but it's not yours!

Agree with you in one sense of being responsible for your own security, but by this logic I should keep all my money under the mattress instead of the bank, no?

[deleted]

Re: Slack was hacked

#106

Post by tracker1 »

NobleLie wrote: post #48
eridius wrote: post #31

> Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form. Is this true even when the attacker is specifically focusing on a single account, or is it only computationally infeasible to recover passwords for accounts in general?

Coincidentally, I was just looking into your question; this should answer your concern. "Since every user has their own unique random salt, two users who happen to have the same password get different salted hashes. [If] the dictionary attack is foiled, the attacker cannot compute the hashes of every word in a dictionary once and then check every hash in the table for matches anymore. Rather, the attacker is going to…

running the top 10k passwords on each hash will likely get quite a few hits, and not take much compute time... the overlap to accounts that are owner/admin accounts is unknown.. just the same entirely possible. (not counting for slack's password complexity requirements)

Re: Slack was hacked

#107

Post by rudolf0 »

sarciszewski wrote: post #21
jmtulloss wrote: post #16

Earlier quoted context omitted.

They go into details about this in the post. It's bcrypt with a salt.

I shudder to imagine anyone bothering to build bcrypt WITHOUT a salt. In general, salt is implied in bcrypt.

Not sure why you're being downvoted. Every bcrypt implementation I've seen always adds a salt as part of the algorithm itself.

Re: Slack was hacked

#108

Post by artursapek »

jscottmiller wrote: post #15
[deleted] wrote: post #9

[deleted]

The article indicates that bcrypt was used. > Slack’s hashing function is bcrypt with a randomly generated salt per-password which makes it computationally infeasible that your password could be recreated from the hashed form.

For hashing passwords, not for encrypting all communication.

Re: Slack was hacked

#109

Post by schrodinger »

SideburnsOfDoom wrote: post #60
ihodes wrote: post #7

Earlier quoted context omitted.

The post notes that the breached database is the user table, which would not contain chat history. I agree that making this abundantly clear makes sense.

If you get the user table, you can log in. If you can log in as (some) users. If you can do that, you can see (some) chat history. edit you can log in if and when you crack some of the hashes.

Incorrect. You can't login with a password hash, you need a password.

Re: Slack was hacked

#110

Post by blfr »

nvk wrote: post #87
blfr wrote: post #74

Earlier quoted context omitted.

It will take you more than 10 minutes to just choose the ircd to use. Not to mention configuration and maintenance. I looked through the ircds available in Debian repositories the other day and they didn't look very fresh. So you might also have to package them from source and make sure that stays up to date. Hosting your own services has some appealing security qualities (like being able to put them in your VPN) but…

Saved you the search; ngircd

I was looking at InspIRCd and UnrealIRCd which seem to be popular among smaller IRC networks. Any reason for that? Are they better suited for public networks?
Post reply on HN