Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack Security Incident

keybase.io

Post reply on HN
Print view View original

21–30 of 110 posts

Re: Slack Security Incident

#21

Post by Alex3917 »

privateSFacct wrote: post #6

Wow - for a sales pitch fantastic. Many of these security issues leave you little to actually do. This write up provides an alternative. What’s super bad here is slack misleading about the cause wasting all the users time. Quick question, anyone use key base - can u give a quick review? Team currently use slack

I use Keybase. I like it, the thing to keep in mind though is 99.9% of the time the biggest threat vector to your company is going to be preventing your employees from sexually harassing each other, not preventing the Russians or whoever from reading your internal messages.

Re: Slack Security Incident

#22

Post by mfer »

numair wrote: post #10

The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message. Let me see if I have this right: Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affecte…

I think the point was a sales pitch. The post worked well enough to get to the top of the Hacker News front page. I think the effort was rewarded.

Re: Slack Security Incident

#23

Post by ashelmire »

Alex3917 wrote: post #7

Not only does Keybase not automatically update its client, there is no way to even figure out if your client is out of date and in need of security updates. Even if you look up the exact version of your installed client, which you can find, there is nothing on the website that says what the most recent version is. The only way to even get a hint is to look on GitHub, and even that isn't accurate; version 4.2.1 is the…

You know what's better than installing slack? Not installing it and using it in the browser.

If there's a website option for any tool, I recommend using that over native. It's usually more performant and is less of a security risk. And it's always up to date.

Re: Slack Security Incident

#24

Post by bluk »

The post says "If the attackers inject server code, 2FA or U2F or any Web-based security practice does little." Understandably if the attacker was actively scraping passwords with 2FAs and was using the credentials immediately, that would be an issue.

However, for the issue mentioned in the post, wouldn't 2FA have saved him? Supposedly, the compromised credential is from 2015.

Re: Slack Security Incident

#25

Post by lonelappde »

save_ferris wrote: post #19
numair wrote: post #10

The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message. Let me see if I have this right: Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affecte…

Would shareholders have a case to make for fraud here? Slack clearly didn't want this information getting out pre-IPO, as a security disclosure in this case would certainly impact public confidence in the company.

bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud

Re: Slack Security Incident

#27

Post by j605 »

Alex3917 wrote: post #7

Not only does Keybase not automatically update its client, there is no way to even figure out if your client is out of date and in need of security updates. Even if you look up the exact version of your installed client, which you can find, there is nothing on the website that says what the most recent version is. The only way to even get a hint is to look on GitHub, and even that isn't accurate; version 4.2.1 is the…

That is why you use a system with a package manager. Maybe you could follow the releases feed on Github. It was what I do when I maintain a package on AUR.

Re: Slack Security Incident

#28

Post by pzduniak »

asdkhadsj wrote: post #11

As people are discussing Keybase for teams and whatnot - could anyone comment on Keybase for individuals, families, etc? My family are debating moving to Matrix (and away from iMessage). I had briefly debates Keybase due to some interesting features. Anyone have experience with Keybase for families and individuals?

It's OK, notifications collapsing is somewhat wonky for some people and some of my friends complain about the app's performance vs something like Facebook but given the security model it will never be as fast.

disclaimer: I work for Keybase

Re: Slack Security Incident

#29

Post by lloeki »

madspindel wrote: post #14
asdkhadsj wrote: post #11

As people are discussing Keybase for teams and whatnot - could anyone comment on Keybase for individuals, families, etc? My family are debating moving to Matrix (and away from iMessage). I had briefly debates Keybase due to some interesting features. Anyone have experience with Keybase for families and individuals?

Why move away from iMessage? It's end-to-end encrypted.

Either one of:

- iOS only

or

- an extremely-crypto/privacy-aware family who is concerned that although end-to-end encrypted, there is no out-of-band user-validated key exchange (e.g through a digit code or QR-Code) or prior validation (e.g per-key TOFU) of the other party's identity or update to their keys. Which means that theoretically Apple could insert a new key in the user's set (there is a key per user's device for perfect backward/forward secrecy†) anytime to MITM/intercept messages and you would not be able to monitor it††.

† This is obviously defeated by Messages in iCloud (which you can disable) but the iMessage protocol has this built in.

†† Of course if there was some feature like that, Apple could also make such a key hidden in some way because they also control the Messages app code.

Re: Slack Security Incident

#30

Post by valar_m »

>By contrast, Keybase currently runs all of its mission critical chat applications over Keybase itself.

Reminds me of the time Amazon learned that using S3 to host status indicators for S3 is a bad idea if S3 goes down.

Post reply on HN