Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What If All Your Slack Chats Were Leaked?

nytimes.com

Post reply on HN
Print view View original

81–90 of 127 posts

Re: What If All Your Slack Chats Were Leaked?

#81

Post by sanderjd »

duxup wrote: post #47
sanderjd wrote: post #34

Earlier quoted context omitted.

So, I think this is a problem and that encryption and data security policies and audits would be a good thing. But your parent's point also resonated with me. This isn't a shocking expose of some giant new problem. Protecting proprietary communication has been a problem for as long as organizations have existed. It was a problem when the solution at Los Alamos was safes in offices, it was a problem with memos, it was…

What qualifies as news? Does it have to be " a shocking expose"? All the things you mentioned about communication seem to apply to this article.

I mean, this is a good philosophical question, and I think the answer tends to just be "whatever a news organization decides to write about", so clearly this counts.

But I think what makes for interesting news are things that are new and non-obvious. The point of the thread starter (which resonated with me) is that this is neither. What rubs me wrong about the article is that it lacks context. From just this article, this sounds like a novel threat. But it's ludicrously far from that. You could write the same article about every communication system used by every business ever. For instance, tons of important stuff is still required to be done by fax, which is far less privacy-preserving than Slack. Email remains pretty much universally unencrypted.

The article doesn't try to grapple with this context at all, which makes it read oddly to me.

Re: What If All Your Slack Chats Were Leaked?

#82

Post by AceyMan »

jeremyjh wrote: post #33
deegles wrote: post #26

I mean, the article is generally right but they immediately get a detail wrong: > Right now, Slack stores everything you do on its platform by default — your username and password ... I would be extremely surprised if they store plaintext or even encrypted passwords. Maybe the author means usernames/passwords sent in messages, but that's not unique to slack.

I’d guess the number of times a password has been shared in a private channel/direct message is a number with quite a lot of 0s behind it.

fwiw, when I have to share a password or api key in a DM once the party acks receipt I then delete the message. Unless a snapshot is taken in the interval I reason that there won't be a persistent copy left behind.

Does anyone 'behind-the-curtain' know anything that would contradict my assumptions?

Re: What If All Your Slack Chats Were Leaked?

#84

Post by Bartweiss »

fencepost wrote: post #75

There seems to be a fundamental assumption here that's just completely wrong, and that is that there's a way to guarantee that your chat logs /email /search history /whatever can ever be 100% secure from disclosure. This is as wrong as assuming you don't need backup because you have RAID, excellent malware protection, are fully patched, have great sprinklers, are geologically stable, not in a flood plain, etc. You ne…

I didn't get that assumption from the article at all. (Unless you meant "on HN" instead?)

To me, the article's focus on permanently deleting old messages specifically avoids that error - it's not about avoiding disclosure but as defense-in-depth since disclosure is always a possibility. Beyond that, avoiding Slack (even with data deletion) is unlikely to increase security, but it does decrease priority for smaller users who might be swept up in an attack on Slack in general.

Re: What If All Your Slack Chats Were Leaked?

#85

Post by rhacker »

mapcars wrote: post #9

First thought: who the hell would be interested to read thousands of lines of discussions like how to name a field in REST response or notifications of someone making a build xD

How about that time we had to discuss employee X's behavior.

The sexualized commentary about employee V's nice boobs.

The CEO arguing that employee M be kept because he's got leverage and we should let employee Z go instead.

That discussion we had about the time a hacker got ahold of 4000 customer records but we paid them off to delete the records.

I dunno, pretty much the stuff that can break a company into nothingness.

(FYI those are not scenarios where I work)

Re: What If All Your Slack Chats Were Leaked?

#86

Post by simonebrunozzi »

zztaway2019 wrote: post #72

I worked for a fortune I reported it to security. Next day I'm suspended. Turns out security did it because they wanted to search through 'just in case' but didn't want to go through the process properly. Either it was my fault or they were incompetent, guess which one they chose. I was forced to quit eventually.

I hope you hired a good lawyer and made them pay handsomely for this. They would have deserved it.

Re: What If All Your Slack Chats Were Leaked?

#87

Post by madeofpalk »

vbezhenar wrote: post #63
madeofpalk wrote: post #32

Earlier quoted context omitted.

A single, shared key? Granted, I don't know much about encryption, end-to-end messaging, or otherwise, but it seems like a Very Hard Problem to solve for something like Slack.

> A single, shared key? Yes, shared among participants. > it seems like a Very Hard Problem to solve for something like Slack. There are plenty of messengers with E2E encryption and group chats with working search. Sure, it's not a straightforward task and server-side handling of search and other functions makes everything much easier, but I don't think that it's impossible task. Though I'm not sure if demand is big…

> Yes, shared among participants.

Honest question - how does this work across thousands of employees, some of which are almost guaranteed to be bad-actors at one point? Or is that just not a problem that's trying to be solved? What are the impacts if someone leaks that?

> There are plenty of messengers with E2E encryption and group chats with working search.

I don't know - are they on the (user) scale of Slack? How many people can you add to a group in WhatsApp or iMessage? (I honestly don't know, but I would suspect Slack lets you have more people in a 'group' than them).

Again, I have only a very cursory knowledge of how iMessage does E2E encryption. Obviously Slack would need to choose a different approach, but I wouldn't look at other messaging apps for examples.

Re: What If All Your Slack Chats Were Leaked?

#88

Post by scotu »

mapcars wrote: post #27
madeofpalk wrote: post #12

Earlier quoted context omitted.

I'm sure the Gawker employees thought the same thing, until their chat logs were brought up in court http://nymag.com/intelligencer/2016/03/what-hulk-hogan-taugh... https://splinternews.com/the-gawker-hulk-hogan-trial-and-the...

The nature of those discussions is quite different. I'm making jokes about our API, not world-known wrestler :)

wait until you are discussing how you should implement that api this way, similar to how it's in java, and then oracle comes at you :D

Re: What If All Your Slack Chats Were Leaked?

#89

Post by codesushi42 »

duxup wrote: post #42
ltbarcly3 wrote: post #39

Earlier quoted context omitted.

Edit: I should have pointed out that the article doesn't say they don't encrypt the data, it just says they don't end-to-end encrypt it, which by definition would require it to be impossible for Slack or anyone else to read the messages (other than the users who sent them or were in the channel at the time they were sent). Only a handful or recent apps like Signal and Telegram even attempt to do this. Any form of com…

I think the fact that Slack communication isn't encrypted is a valid news article. I don't think that because the topic is "hot" that makes talking about it "no reason other than". I feel like there is a surprising volume of "oh man why did the author bring this up" type posts on HN, I don't get it. The topic seems valid.

Exactly, there is no good reason why Slack doesn't at least provide the option to end to end encrypt conversations.

I hope that stories like this continue so that e2e encryption is supported by any messaging platform that wants to be taken seriously.

Re: What If All Your Slack Chats Were Leaked?

#90

Post by yters »

Slack seems like a huge single point of failure. The chat logs across who knows how many companies and groups all stored on a single set of servers by a single company. All it takes is one bad insider with the keys to the kingdom, or just a government backend into the system, and all the secrets are loosed. And who's to say Slack employees don't watch our chat logs already? I really don't get the amount of trust placed in Slack, especially in the IT industry where everyone is very aware of security.
Post reply on HN