Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

21–30 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#21

Post by grinich »

timetopay wrote: post #15
tw04 wrote: post #13

Earlier quoted context omitted.

Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.

SCIM adoption isn't near where it needs to be. I guess yeah, this is the correct answer. We live in a world where SSO is considered an enterprise feature, I hope one day that it's considered default.

Shameless plug for my startup (hope that's ok!)

If you're building an app and need to add SCIM, check out WorkOS. My email is in my profile to chat.

More info -> https://workos.com/directory-sync

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#22

Post by [deleted] »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

[deleted]

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#23

Post by grinich »

dazbradbury wrote: post #20
reactordev wrote: post #16

Earlier quoted context omitted.

Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.

Presumably with SAML/SSO you can still change your slack display name and profile picture?

The data only comes during the sign-in flow. If you want to change it dynamically outside of that, it's typically done via SCIM.

For anyone curious, we wrote a blog post all about this. https://workos.com/blog/the-developers-guide-to-directory-sy...

(I work at WorkOS.)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#24

Post by neom »

dazbradbury wrote: post #20
reactordev wrote: post #16

Earlier quoted context omitted.

Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.

Presumably with SAML/SSO you can still change your slack display name and profile picture?

Not slack, we use teams at work and I have very limited ability to do anything, can't change my name and we have profile pics disabled.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#25

Post by dancemethis »

neilv wrote: post #4

> Of course, not every company will fall for this trick The company can have the last laugh: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

well, Slack is the one having the last laugh, since they get their hands on a lot of "sensitive business data".

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#26

Post by cco »

timetopay wrote: post #12
vlovich123 wrote: post #7

Normally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.

One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).

>...using a third party vendor (costly).

I promise we're not _that_ costly.

But yes, having built a slackbot/Slack OAuth myself and dealing with it at my $CURRENT_CO (stytch.com), Slack is a service you have to be very careful with. They offer a very powerful API and permissioning model, but it can be nerve wracking.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#28

Post by bongodongobob »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

Uh, it does allow that in the organization settings. Also the SAML/SSO comment below as well. If you can change names, IT admins are either non-existent or just being lazy.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#29

Post by InitialLastName »

toomuchtodo wrote: post #2

Best place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!

On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#30

Post by toomuchtodo »

InitialLastName wrote: post #29
toomuchtodo wrote: post #2

Best place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!

On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.

Institutional knowledge and documentation is not free, but it has a cost!
Post reply on HN