Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack Security Incident

keybase.io

Post reply on HN
Print view View original

91–100 of 110 posts

Re: Slack Security Incident

#91

Post by bmurphy1976 »

bpchaps wrote: post #86
the_duke wrote: post #20

Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident. This is the important part, which everyone should think about: > What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, o…

At my last job, I wrote a little tool to download hipchat chat logs and scrape them for anything that looks like a password. There were tons!! I raised it to the CTO/CIO, and while they sounded interested in it, they never enacted any policies, etc, to prevent the sort of password sharing that anyone can apparently easily take advantage of. In fact, the CIO asked me to send him a spreadsheet of when/where passwords w…

The correct answer is routine password rotation, but of course that's stupidly hard to do.

Re: Slack Security Incident

#92

Post by sucrose »

privateSFacct wrote: post #6

Wow - for a sales pitch fantastic. Many of these security issues leave you little to actually do. This write up provides an alternative. What’s super bad here is slack misleading about the cause wasting all the users time. Quick question, anyone use key base - can u give a quick review? Team currently use slack

Keybase has a Teams feature so it's built more towards your use-case. I use it to trade Stellar (XLM), file storage/management, and sharing/proving all of my platform identities. I haven't had a chance to get too social on it yet so I can't comment on the chatting experience, but overall it's a neat platform. It also has a command-line interface.

If you end up signing-up, follow me @ https://keybase.io/jbales

Re: Slack Security Incident

#93

Post by johnmarcus »

the_duke wrote: post #20

Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident. This is the important part, which everyone should think about: > What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, o…

Ive been considering building a product that would help eradicate "lax user management" of Slack, and like platforms. It would basically keep an audit trail of managers approval for their specific team members they manage access to specific platforms and products. Basically, helping scale that one IT guy whom should somehow know every person at the company in detail.

If I succeeded in making the process easy & less time consuming than it is now, do you think it's a product you would pay for?

Re: Slack Security Incident

#94

Post by bmurphy1976 »

throwanem wrote: post #81
gtirloni wrote: post #57

Earlier quoted context omitted.

I don't understand this. They say that if you delete your workspace, all messages are gone. https://get.slack.help/hc/en-us/articles/204067366-Delete-a-...

It says they're "irretrievable", which isn't necessarily the same thing. That you can't get that data back doesn't mean it's no longer stored by Slack in a way that a sufficiently severe compromise of their infrastructure might reveal.

It probably means the data is encrypted at rest and they discard the encryption key. Of course I doubt we'll ever know because they won't give us that level of detail unless they are compelled to.

Re: Slack Security Incident

#95

Post by eeeeeeeeeeeee »

bmurphy1976 wrote: post #91
bpchaps wrote: post #86

Earlier quoted context omitted.

At my last job, I wrote a little tool to download hipchat chat logs and scrape them for anything that looks like a password. There were tons!! I raised it to the CTO/CIO, and while they sounded interested in it, they never enacted any policies, etc, to prevent the sort of password sharing that anyone can apparently easily take advantage of. In fact, the CIO asked me to send him a spreadsheet of when/where passwords w…

The correct answer is routine password rotation, but of course that's stupidly hard to do.

I don’t agree with that. Regular password rotation increases the opportunity for phishing attacks because people become used to sleep walking through it. And users are generally just adding one or two characters to the password anyway.

Instead, that energy is better spent on requiring strong passwords and people using password managers and two-factor.

Re: Slack Security Incident

#96

Post by xtracto »

the_duke wrote: post #20

Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident. This is the important part, which everyone should think about: > What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, o…

> or had our team traded API keys, or security-sensitive matters; or had we controlled mission-critical infrastructure via Slack-powered "bots"

That's why I always strongly recommend having a https://privatebin.info/ . In fact, in every startup I have been, I setup an instance of that forcing "burn after reading" and as a policy all credentials and sensitive info goes there when sharing.

Re: Slack Security Incident

#97

Post by asdkhadsj »

pzduniak wrote: post #28
asdkhadsj wrote: post #11

As people are discussing Keybase for teams and whatnot - could anyone comment on Keybase for individuals, families, etc? My family are debating moving to Matrix (and away from iMessage). I had briefly debates Keybase due to some interesting features. Anyone have experience with Keybase for families and individuals?

It's OK, notifications collapsing is somewhat wonky for some people and some of my friends complain about the app's performance vs something like Facebook but given the security model it will never be as fast. disclaimer: I work for Keybase

Appreciate your response. After finding out how Keybase is funded, the model has me worried about relying on the future of a magically[1] funded platform compared to something I could self-host like Matrix.

Do you have any insight on why I shouldn't be concerned?

[1]: since I don't have clear funding motivations I'm referring to it as magical.

Re: Slack Security Incident

#99

Post by pmh »

eeeeeeeeeeeee wrote: post #95
bmurphy1976 wrote: post #91

Earlier quoted context omitted.

The correct answer is routine password rotation, but of course that's stupidly hard to do.

I don’t agree with that. Regular password rotation increases the opportunity for phishing attacks because people become used to sleep walking through it. And users are generally just adding one or two characters to the password anyway. Instead, that energy is better spent on requiring strong passwords and people using password managers and two-factor.

Password rotation in this context is for the infrastructure, not normal user accounts.

There are other options for securing/managing infrastructure access (e.g. PKI, Hashicorp Vault), but if you're using passwords, it's a good idea to rotate them if only to encourage good practices around automation.

Re: Slack Security Incident

#100

Post by icebraining »

emdowling wrote: post #8

Encryption for a business chat app limits the potential users rather significantly, as I understand it. A number of sectors (like banking) have strict rules which require keeping a record of company communications. How does Keybase deal with this, or do they choose not to play in that market?

Well, the bank could still record from their end of the conversation, capturing the chat logs from the employee's terminal and shipping them somewhere.
Post reply on HN