Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack Security Incident

keybase.io

Post reply on HN
Print view View original

61–70 of 110 posts

Re: Slack Security Incident

#61

Post by dx87 »

FabHK wrote: post #39
ashelmire wrote: post #23

Earlier quoted context omitted.

You know what's better than installing slack? Not installing it and using it in the browser. If there's a website option for any tool, I recommend using that over native. It's usually more performant and is less of a security risk. And it's always up to date.

> It's usually more performant and is less of a security risk. Source, particularly for the "less of a security risk"? (It might well be now, I'm not an expert, but a few years ago I'd have thought "no way").

Software running in a browser is probably going to heavily sandboxed and have tight restrictions on what it can access since the purpose of a browser is to run untrusted code. Native software will usually have minimal sandboxing because it's supposed to be trusted, and can do anything the user running it could do.

As far as performance, I think that only applies to apps like Slack and Spotify that use Electron to pretend to be a native app.

Re: Slack Security Incident

#62

Post by zuck9 »

> Were our Dutch friends sifting through our messages for four years before Slack notified us of a suspicious login?

The author might know this already but the hackers aren't Dutch. They simply bought a cheap NL server from LeaseWeb to mask their real IP.

Re: Slack Security Incident

#63

Post by AJ007 »

harryh wrote: post #54
the_duke wrote: post #20

Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident. This is the important part, which everyone should think about: > What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, o…

Slack has some options to delete all messages over N days old. Unless there is a really good reason not to, turning on this feature generally sounds like a good idea. At least you can drastically limit the length of the archive available to any attacker.

I strongly suggest not transmitting secure information or files via Slack or any other medium that retains or broadcasts (push notifications, email alerts) data.

Given the massive and escalating fines over customer data hacks and leaks I suspect we will see laws requiring data retention going head to head with consumer privacy laws. Given that even Jeff Bezos can’t keep his communications secure, the outlook for infosec consultants is fantastic. If anti-encryption laws start appearing on top of all of this, it’s going to be an absolute bonanza.

Re: Slack Security Incident

#64

Post by Ntrails »

harryh wrote: post #54
the_duke wrote: post #20

Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident. This is the important part, which everyone should think about: > What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, o…

Slack has some options to delete all messages over N days old. Unless there is a really good reason not to, turning on this feature generally sounds like a good idea. At least you can drastically limit the length of the archive available to any attacker.

That's a terrible feature in an instant messenger client for work use? I cannot recall the precise details of my conversations with smart people who know things I do not. I can recall that I had the conversation and remind myself what I learned before.

Re: Slack Security Incident

#65

Post by simonebrunozzi »

mfer wrote: post #22
numair wrote: post #10

The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message. Let me see if I have this right: Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affecte…

I think the point was a sales pitch. The post worked well enough to get to the top of the Hacker News front page. I think the effort was rewarded.

Most things related to Keybase go to the top of Hacker News. The company has many HNers.

I like their products a lot; I wish they were a bit less self-promoting, as it is in fact the case here.

Re: Slack Security Incident

#66

Post by Alex3917 »

kbModalduality wrote: post #46
Alex3917 wrote: post #7

Not only does Keybase not automatically update its client, there is no way to even figure out if your client is out of date and in need of security updates. Even if you look up the exact version of your installed client, which you can find, there is nothing on the website that says what the most recent version is. The only way to even get a hint is to look on GitHub, and even that isn't accurate; version 4.2.1 is the…

Keybase developer here. Keybase does automatically update on Mac, and you can check if you're out of date on the CLI with `keybase update check`. Additionally, the "widget" popup from the system tray will display an out of date banner automatically. 4.2.1 was a bugfix release that only affected Linux and BSD, so we didn't push out Mac or Windows releases for it.

> Keybase developer here. Keybase does automatically update on Mac

Interesting, is this relatively recent? It didn't update for me, but I hadn't opened it in at least six months.

Also, that CLI command should probably be wrapped in a "Check for update" menu option.

Re: Slack Security Incident

#67

Post by nabeards »

privateSFacct wrote: post #6

Wow - for a sales pitch fantastic. Many of these security issues leave you little to actually do. This write up provides an alternative. What’s super bad here is slack misleading about the cause wasting all the users time. Quick question, anyone use key base - can u give a quick review? Team currently use slack

I’ve been running my 100% remote team on it the last few months, it works very well for us. Never been a fan of Slack, and never use any bots, so just comms.

Re: Slack Security Incident

#68

Post by mikeash »

TrueDuality wrote: post #60
mikeash wrote: post #50

Earlier quoted context omitted.

It won’t prevent an attacker from logging in as you at the moment, but it will prevent them from using stolen credentials later on.

If they can inject server code, they can bypass 2FA entirely. They don't need your 2FA code they'll just skip that part of the authentication. The same goes for passwords, but with passwords there is the potential of additional value on other sites that haven't been compromised so those are always worth collecting.

This particular scenario involved injecting server code in 2015, then waiting until 2019 to use the credentials they collected. They would not be able to bypass 2FA here.

It’s true that 2FA wouldn’t protect you from having your account compromised immediately, but that’s not what happened.

Re: Slack Security Incident

#69

Post by manigandham »

Ntrails wrote: post #64
harryh wrote: post #54

Earlier quoted context omitted.

Slack has some options to delete all messages over N days old. Unless there is a really good reason not to, turning on this feature generally sounds like a good idea. At least you can drastically limit the length of the archive available to any attacker.

That's a terrible feature in an instant messenger client for work use? I cannot recall the precise details of my conversations with smart people who know things I do not. I can recall that I had the conversation and remind myself what I learned before.

Depends entirely on the conversation obviously, but perhaps important details should eventually be coalesced and moved to a more permanent document or project management system before the deletion deadline. It's a good discipline to have.

Re: Slack Security Incident

#70

Post by chrissnell »

numair wrote: post #10

The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message. Let me see if I have this right: Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affecte…

This is the "lite" version of his sales pitch. The real sales pitch was the email that Keybase users just received. It said, basically, that Slack was compromised but if you would have used Keybase instead, you wouldn't have been compromised.

Awkward, indeed.

I cringe when I see companies try to use a competitor's misfortune to their advantage.

Post reply on HN