Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

51–60 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#51

Post by p1mrx »

makeitdouble wrote: post #43
dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

At the same time the ability to change name is sich a godsend. We're currently abusing it to have presence info straight in the display name (e.g. mike-2/12~16vac.) to let anyone contacting us what to expect for response times, or wether to ask for a task if it's a few days before a planned vacation. Nobody seemed to look at the actual status property and it beats going to the calendars to check.

> mike-2/12~16vac

Looks like mike-2 is a robot powered by a doorbell transformer.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#52

Post by twodave »

One place I worked was slow to deactivate slack accounts, so when I left I made a private channel #daves_cave and invited friends my friends to it. I would leave a short story or pithy saying now and then; it was fun until management got wise and deactivated me.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#53

Post by nightpool »

bongodongobob wrote: post #45
bigyikes wrote: post #41

Earlier quoted context omitted.

My company allows name changes. It’s fun.

That means they're not using SAML/SSO which sounds absolutely crazy to me, unless you only have like a dozen users. The implication is that your IT team doesn't take security seriously. Not because you can change names, but because they aren't implementing identity policies.

Eh, a lot of startups even in the 100-200 employee range are still manually inviting Slack members. It's not really the end of the world as long as you're on top of things and have good communication between HR, IT, etc. Spreadsheets solve a lot of problems (in this case, having a good template offboarding/onboarding spreadsheet in Google drive that everyone can collaborate on to make sure stuff gets done quickly).

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#54

Post by leeter »

tw04 wrote: post #13
timetopay wrote: post #12

Earlier quoted context omitted.

One thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).

Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.

Me: "We should use SCIM, our IDP and our App both support it" PM: "No that's too complicated, we'll roll our own provisioning and never worry about de-provisioning because they won't be able to log in due to SAML anyway!"

I can't tell you how many times I've had that conversation... but I'd need at least both hands and a foot.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#55

Post by foobiekr »

justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

I spent months passively waiting for a former employer to evict me from Slack. It was genuinely bizarre, almost a year later I still had full access to a ton of internal channels.

They are friends, but this was not them being friendly, it was just because slack account management integration with Google Office is a dumpster fire.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#57

Post by at_a_remove »

InitialLastName wrote: post #29
toomuchtodo wrote: post #2

Best place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!

On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.

Dang. Our scream test was just "disable if nobody could tell what it was for."

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#58

Post by grogenaut »

bongodongobob wrote: post #45
bigyikes wrote: post #41

Earlier quoted context omitted.

My company allows name changes. It’s fun.

That means they're not using SAML/SSO which sounds absolutely crazy to me, unless you only have like a dozen users. The implication is that your IT team doesn't take security seriously. Not because you can change names, but because they aren't implementing identity policies.

you can very much allow people to change display names while using saml/sso. My work setup allows this. We can change photo and description as well but nothing else.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#59

Post by paradox460 »

foobiekr wrote: post #55
justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

I spent months passively waiting for a former employer to evict me from Slack. It was genuinely bizarre, almost a year later I still had full access to a ton of internal channels. They are friends, but this was not them being friendly, it was just because slack account management integration with Google Office is a dumpster fire.

I've got one up on this. I kept my insurance from a past company for nearly 2 years after I got laid off. Would have rather they cancelled it, as it caused a massive headache around the time my son was born

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#60

Post by grinich »

leeter wrote: post #54
tw04 wrote: post #13

Earlier quoted context omitted.

Sure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.

Me: "We should use SCIM, our IDP and our App both support it" PM: "No that's too complicated, we'll roll our own provisioning and never worry about de-provisioning because they won't be able to log in due to SAML anyway!" I can't tell you how many times I've had that conversation... but I'd need at least both hands and a foot.

This is why most SSO forces you to sign in again every day. So frustrating!
Post reply on HN