16 ms·

More like "How Slack Thinks It Stays Secure..." A sophisticated attack against Slack would be for the purpose of maintaining long-term access to chat data. The

More like "How Slack Thinks It Stays Secure..." A sophisticated attack against Slack would be for the purpose of maintaining long-term access to chat data. There's no reason to believe Slack would ever be able to detect someone exfiltrating chat logs. They might catch some attacks but customers can not rightly expect that that their privacy is being maintained. Data being stolen is more likely than not. Slack chat should be treated like semi-public communication, with the expectation that it will all end up in a torrent file at some point. The idea that you can "secure" unencrypted text chats using a Security Team with Executive Leadership is pure theater. If Slack took security seriously it would utilize end-to-end encryption.

packetized 9y ago
It’s somewhat harder to be a Searchable Log of All (Company|Current) Knowledge if you utilize end-to-end encryption. Where are the ends?
- meritt 9y ago
  This is my biggest objection to Slack. Give me an application/container/whatever I can run on our network instead. I do not trust them with my entire company chat history stored in plaintext on the same cluster as every other company.
  - BoorishBears 9y ago
    I feel like more often than not, organizations apply this logic to SaaSes that offers on-prem installations, and choose the on-prem over the hosted solution... only to leave the installation out of date with critical vulnerabilities and missing features that the hosted installation would be on top of.
    - cortesoft 9y ago
      There is nothing stopping an on-prem appliance from being able to automatically update. Of course, once you do that, you are again putting trust back into the third party, so you lose some of what you gained.
      - BoorishBears 9y ago
        I don't think I've ever seen an on-prem application that self updated without manual intervention. I'm sure it exists, but it doesn't seem common. Probably because in general self-updating goes against the control on-prem is supposed to give enterprises, especially when they're afraid of breaking critical workflows.
    - hueving 9y ago
      If it's not exposed to the internet, an out of date on-prem is still better than everything on a massive centralized public vendor server that 5 nation states are hacked into.
      - praneshp 9y ago
        If 5 nation states hacked into the centralized public vendor they'll find a way to get into someone's on-prem version of the same, especially if they are the type to let it go very out of date.
        hueving 9y ago
        The difference is that they will only hack into your on-prem solution if you are the target. With a central service, all of slack's million customers get compromised because of one single hack.
        praneshp 9y ago
        Correct, I didn't think of that.
      - BoorishBears 9y ago
        GitLab had a permission escalation issue that I saw unpatched on an on-Prem install. Contractors accessing it via VPN (and even local employees) would have been able to access repos and actions they didn’t have permission to access. And it’s not like nation states can’t attack companies directly.
        hueving 9y ago
        Nation states only attack companies they care about. That's the point. Once you have your info on slack, you share the fate with the million other companies that nation states might care about.
  - lima 9y ago
    Nowadays there are excellent self-hosted alternatives (Zulip, Mattermost, Rocket Chat...). That being said: A company-wide Discourse forum works much better for knowledge sharing and discussions.
    - qznc 9y ago
      Has anybody ever merged chat and forums? At least integrate them so tightly that switching back and forth is fluid.
  - Tushon 9y ago
    That's not what they are ever going to provide, like the parent comment indicated because it isn't their goal. Companies or individuals which need your requirement should/are already using a competitor that does allow you to do so, with all the limitations that the extra security gets you (search, integrations, etc), e.g. mattermost or rocket.
- okreallywtf 9y ago
  Would allowing organizations to manage their own key(s) suffice? If all of the stored data was encrypted by the users (even if it was a single key for a client organization), that would do a lot. You would have to compromise the private key(s) for the organization as well as Slacks (now useless) data.
  - meritt 9y ago
    How does Slack provide a search service if the data is encrypted by keys they do not control?
    - deleted 9y ago
      [deleted]
    - okreallywtf 9y ago
      I see your point. Is it possible to achieve that type of functionality with a reasonable expectation of security?
      - cortesoft 9y ago
        Well, if you want slack to be able to search chats history, it needs to be able to access it in some way. So if your 'resonable expectation of security' involves slack not being able to read your chat history, you are going to have to give up search. Otherwise, the reasonable expectation of security will have to rely on trusting slack to properly secure their side of things.
    - nerfhammer 9y ago
      run the tokenizer on the client side, client submits encrypted tokens to the search index. or don't provide a search service, have client have its own local index.
      - meritt 9y ago
        > run the tokenizer on the client side, client submits encrypted tokens to the search index. That would be an incredibly insecure method of encryption. > or don't provide a search service, have client have its own local index. Yep, I would prefer an on-prem solution.
- empath75 9y ago
  It seems like being a searchable log of all company knowledge would make it super important to have encrypted.
dsacco 9y ago
Taking your criticism to its logical conclusion, are you asking for end-to-end encryption on every online mode of communication in order to consider it secure? When security engineers and cryptographers analyze an application, they frame their analysis in the context of security goals, threat models and categories of risk. They don't begin from the perspective that application security is a boolean property - i.e. that the software is either secure under the most strenuous of requirements or simply insecure. That's not how any of this works. All security analysis exists on a continuum between safety and usability. Not all messaging software needs to be secure enough that it could be used as an anti-censorship platform or to facilitate secure communication from journalists in totalitarian regimes. For most companies it's enough that their data is protected through strong application security mechanisms, and Slack devotes significant resources to that task. In addition, customers choose to use Slack for its features. As others have pointed out, some of these features (like message search, or an audit log for direct messages between team members) cannot exist under an end-to-end encrypted model. If you want to use Slack, that means you want to use Slack's features. It's pointless to demand Slack to become something it's fundamentally incompatible with. If you want confidentiality assurance at the highest echelons of computational security, just use something else.
- intelhearts 9y ago
  > are you asking for end-to-end encryption on every online mode of communication in order to consider it secure? that's not unreasonable at all
  - EpicEng 9y ago
    It absolutely is. I niether need nor want end to end encryption in slack. Yesterday I searched for a months old message which would not have been possible if everything we're encrypted all of the way through. We're not the CIA and slack is secure enough for us.
    - deleted 9y ago
      [deleted]
    - 9y ago
cortesoft 9y ago
End-to-end encryption with full search and chat history is pretty hard to do.
hinkley 9y ago
A fun dinner conversation is to ask people how we know what the crime rate is. "Crime is down." they say. Is it? The crime rate is hinged on when a crime is detected. If I'm forgetful and you snag one of my power bricks I might just think I misplaced it or it got thrown away. If you've been embezzling and I can't tell yet I can't report it. Crimes are being committed whether they get reported or not. We count on them having personality flaws like poor judgement and thrill seeking assuming they will eventually be caught. But if there are people who can go into a casino once a year and spend exactly $100, why can't there be criminals who steal $100 once a year and never get caught?
- PJDK 9y ago
  Off topic, but you get around this problem by surveying people's experience of crime, rather than look at police reports. In the UK the survey is called the British Crime Survey and it's pretty robust in it's methodology (although not without criticisim). https://en.wikipedia.org/wiki/Crime_Survey_for_England_and_Wales https://en.wikipedia.org/wiki/Crime_Survey_for_England_and_W...
  - droopyEyelids 9y ago
    It's so off topic that you're not even talking about the same problem when you say "you get around this problem" What a confusing post.
- verylittlemeat 9y ago
  I really don't see this as anything other than a gotcha argument and I feel bad for anyone you tried to use it on who couldn't defend themselves in the heat of the moment. The crime rate is a known political tool that is actively manipulated for political gain (stop and frisk anyone?). Everyone knows that being "tough on crime" is moral statement not a statement of fact. Outside of crime averages that operate on a continuum the crime rate is so subjective as to almost be useless. I would say "the crime rate is down" as an argument is roughly equivalent to believing that any given president has an impact on the DJIA. Look at the cover of the NYPOST yesterday[0]. Attributing a president who has been in office for a year with anything having to do with the economy is almost always untrue [1]. In fact, if anything it's more likely that Trump is benefiting from the policies of his predecessor. So in conclusion the "crime rate" is never up or down, it's just one tool in the political handbook to try and manipulate people with fear, uncertainty and doubt. As a basis of establishing policy it's almost always rhetoric. To further elaborate on your comment, it has less to do with when a crime is "detected" and more to do with what is a crime. [0] https://i.imgur.com/uifDjWI.png https://i.imgur.com/uifDjWI.png [1] https://fivethirtyeight.com/features/a-presidents-economic-decisions-matter-eventually/ https://fivethirtyeight.com/features/a-presidents-economic-d...
nemothekid 9y ago
I’m having trouble fully understanding your argument. Is your argument that all non e2e communication is insecure, or that slack is incompetent? If it’s the former, should I consider tools like Gmail, and the google security infrastructure as security theater? If it’s the latter, then why? The idea that I should expect all my gmail messages to end up in a torrent somewhere is a pretty audacious claim. I don’t pretend to believe that it won’t happen, but if it does, I can’t pretend I would have been more prepared than google when it comes to hosting my own email.
- JumpCrisscross 9y ago
  > Is your argument that all non e2e communication is insecure I think this. (In the context of a company, communications where the company doesn't hold all the keys.) Insecure modes aren't useless. But they certainly shouldn't be used to share sensitive information.
  - codefined 9y ago
    E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack. One of the simplest issues I can see is the search functionality, something I use daily in Slack and would sorely miss not having. Elasticsearch requires access to the contents of a message to index it (basic requirement). Another thing that would become difficult would be adding people to a group, although my technical knowledge in this area is perhaps not massive, my thoughts are that if a user can join a group with another key, surely a Slack attacker would also be able to add their own key? I'm sure there are many other things that ensure Slack cannot be E2E encrypted since it stops a significant amount of the logic they can do (they would become a dumb proxy), similar to why Google hasn't gone E2E.
    - JumpCrisscross 9y ago
      > E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack As I said, not every communication mode must be secure. Slack trades off security for other features, and that is okay. It's odd for Slack to be beating their chest, however, about staying secure when security is not a feature they optimize for.
pfarnsworth 9y ago
How hard would it be for the Russian or Chinese governments to install one of their top programmers into a high-value target like Google, Facebook, Slack, etc and have them introduce subtle bugs that could be used to crack into the private data? If they're not doing this right now I would be shocked.
Spooky23 9y ago
I think that’s an extreme position that priorities some platonic ideal over form, function and utility. It’s certainly reasonable to expect a platform owner to be able to control access and integrity of customer data without encryption, for many use cases.

packetized 9y ago

It’s somewhat harder to be a Searchable Log of All (Company|Current) Knowledge if you utilize end-to-end encryption. Where are the ends?

meritt 9y ago
This is my biggest objection to Slack. Give me an application/container/whatever I can run on our network instead. I do not trust them with my entire company chat history stored in plaintext on the same cluster as every other company.
- BoorishBears 9y ago
  I feel like more often than not, organizations apply this logic to SaaSes that offers on-prem installations, and choose the on-prem over the hosted solution... only to leave the installation out of date with critical vulnerabilities and missing features that the hosted installation would be on top of.
  - cortesoft 9y ago
    There is nothing stopping an on-prem appliance from being able to automatically update. Of course, once you do that, you are again putting trust back into the third party, so you lose some of what you gained.
    - BoorishBears 9y ago
      I don't think I've ever seen an on-prem application that self updated without manual intervention. I'm sure it exists, but it doesn't seem common. Probably because in general self-updating goes against the control on-prem is supposed to give enterprises, especially when they're afraid of breaking critical workflows.
  - hueving 9y ago
    If it's not exposed to the internet, an out of date on-prem is still better than everything on a massive centralized public vendor server that 5 nation states are hacked into.
    - praneshp 9y ago
      If 5 nation states hacked into the centralized public vendor they'll find a way to get into someone's on-prem version of the same, especially if they are the type to let it go very out of date.
      - hueving 9y ago
        The difference is that they will only hack into your on-prem solution if you are the target. With a central service, all of slack's million customers get compromised because of one single hack.
        praneshp 9y ago
        Correct, I didn't think of that.
    - BoorishBears 9y ago
      GitLab had a permission escalation issue that I saw unpatched on an on-Prem install. Contractors accessing it via VPN (and even local employees) would have been able to access repos and actions they didn’t have permission to access. And it’s not like nation states can’t attack companies directly.
      - hueving 9y ago
        Nation states only attack companies they care about. That's the point. Once you have your info on slack, you share the fate with the million other companies that nation states might care about.
- lima 9y ago
  Nowadays there are excellent self-hosted alternatives (Zulip, Mattermost, Rocket Chat...). That being said: A company-wide Discourse forum works much better for knowledge sharing and discussions.
  - qznc 9y ago
    Has anybody ever merged chat and forums? At least integrate them so tightly that switching back and forth is fluid.
- Tushon 9y ago
  That's not what they are ever going to provide, like the parent comment indicated because it isn't their goal. Companies or individuals which need your requirement should/are already using a competitor that does allow you to do so, with all the limitations that the extra security gets you (search, integrations, etc), e.g. mattermost or rocket.
okreallywtf 9y ago
Would allowing organizations to manage their own key(s) suffice? If all of the stored data was encrypted by the users (even if it was a single key for a client organization), that would do a lot. You would have to compromise the private key(s) for the organization as well as Slacks (now useless) data.
- meritt 9y ago
  How does Slack provide a search service if the data is encrypted by keys they do not control?
  - deleted 9y ago
    [deleted]
  - okreallywtf 9y ago
    I see your point. Is it possible to achieve that type of functionality with a reasonable expectation of security?
    - cortesoft 9y ago
      Well, if you want slack to be able to search chats history, it needs to be able to access it in some way. So if your 'resonable expectation of security' involves slack not being able to read your chat history, you are going to have to give up search. Otherwise, the reasonable expectation of security will have to rely on trusting slack to properly secure their side of things.
  - nerfhammer 9y ago
    run the tokenizer on the client side, client submits encrypted tokens to the search index. or don't provide a search service, have client have its own local index.
    - meritt 9y ago
      > run the tokenizer on the client side, client submits encrypted tokens to the search index. That would be an incredibly insecure method of encryption. > or don't provide a search service, have client have its own local index. Yep, I would prefer an on-prem solution.
empath75 9y ago
It seems like being a searchable log of all company knowledge would make it super important to have encrypted.

dsacco 9y ago

Taking your criticism to its logical conclusion, are you asking for end-to-end encryption on every online mode of communication in order to consider it secure? When security engineers and cryptographers analyze an application, they frame their analysis in the context of security goals, threat models and categories of risk. They don't begin from the perspective that application security is a boolean property - i.e. that the software is either secure under the most strenuous of requirements or simply insecure. That's not how any of this works. All security analysis exists on a continuum between safety and usability. Not all messaging software needs to be secure enough that it could be used as an anti-censorship platform or to facilitate secure communication from journalists in totalitarian regimes. For most companies it's enough that their data is protected through strong application security mechanisms, and Slack devotes significant resources to that task. In addition, customers choose to use Slack for its features. As others have pointed out, some of these features (like message search, or an audit log for direct messages between team members) cannot exist under an end-to-end encrypted model. If you want to use Slack, that means you want to use Slack's features. It's pointless to demand Slack to become something it's fundamentally incompatible with. If you want confidentiality assurance at the highest echelons of computational security, just use something else.

intelhearts 9y ago
> are you asking for end-to-end encryption on every online mode of communication in order to consider it secure? that's not unreasonable at all
- EpicEng 9y ago
  It absolutely is. I niether need nor want end to end encryption in slack. Yesterday I searched for a months old message which would not have been possible if everything we're encrypted all of the way through. We're not the CIA and slack is secure enough for us.
  - deleted 9y ago
    [deleted]
  - 9y ago

cortesoft 9y ago

End-to-end encryption with full search and chat history is pretty hard to do.

hinkley 9y ago

A fun dinner conversation is to ask people how we know what the crime rate is. "Crime is down." they say. Is it? The crime rate is hinged on when a crime is detected. If I'm forgetful and you snag one of my power bricks I might just think I misplaced it or it got thrown away. If you've been embezzling and I can't tell yet I can't report it. Crimes are being committed whether they get reported or not. We count on them having personality flaws like poor judgement and thrill seeking assuming they will eventually be caught. But if there are people who can go into a casino once a year and spend exactly $100, why can't there be criminals who steal $100 once a year and never get caught?

PJDK 9y ago
Off topic, but you get around this problem by surveying people's experience of crime, rather than look at police reports. In the UK the survey is called the British Crime Survey and it's pretty robust in it's methodology (although not without criticisim). https://en.wikipedia.org/wiki/Crime_Survey_for_England_and_Wales https://en.wikipedia.org/wiki/Crime_Survey_for_England_and_W...
- droopyEyelids 9y ago
  It's so off topic that you're not even talking about the same problem when you say "you get around this problem" What a confusing post.
verylittlemeat 9y ago
I really don't see this as anything other than a gotcha argument and I feel bad for anyone you tried to use it on who couldn't defend themselves in the heat of the moment. The crime rate is a known political tool that is actively manipulated for political gain (stop and frisk anyone?). Everyone knows that being "tough on crime" is moral statement not a statement of fact. Outside of crime averages that operate on a continuum the crime rate is so subjective as to almost be useless. I would say "the crime rate is down" as an argument is roughly equivalent to believing that any given president has an impact on the DJIA. Look at the cover of the NYPOST yesterday[0]. Attributing a president who has been in office for a year with anything having to do with the economy is almost always untrue [1]. In fact, if anything it's more likely that Trump is benefiting from the policies of his predecessor. So in conclusion the "crime rate" is never up or down, it's just one tool in the political handbook to try and manipulate people with fear, uncertainty and doubt. As a basis of establishing policy it's almost always rhetoric. To further elaborate on your comment, it has less to do with when a crime is "detected" and more to do with what is a crime. [0] https://i.imgur.com/uifDjWI.png https://i.imgur.com/uifDjWI.png [1] https://fivethirtyeight.com/features/a-presidents-economic-decisions-matter-eventually/ https://fivethirtyeight.com/features/a-presidents-economic-d...

nemothekid 9y ago

I’m having trouble fully understanding your argument. Is your argument that all non e2e communication is insecure, or that slack is incompetent? If it’s the former, should I consider tools like Gmail, and the google security infrastructure as security theater? If it’s the latter, then why? The idea that I should expect all my gmail messages to end up in a torrent somewhere is a pretty audacious claim. I don’t pretend to believe that it won’t happen, but if it does, I can’t pretend I would have been more prepared than google when it comes to hosting my own email.

JumpCrisscross 9y ago
> Is your argument that all non e2e communication is insecure I think this. (In the context of a company, communications where the company doesn't hold all the keys.) Insecure modes aren't useless. But they certainly shouldn't be used to share sensitive information.
- codefined 9y ago
  E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack. One of the simplest issues I can see is the search functionality, something I use daily in Slack and would sorely miss not having. Elasticsearch requires access to the contents of a message to index it (basic requirement). Another thing that would become difficult would be adding people to a group, although my technical knowledge in this area is perhaps not massive, my thoughts are that if a user can join a group with another key, surely a Slack attacker would also be able to add their own key? I'm sure there are many other things that ensure Slack cannot be E2E encrypted since it stops a significant amount of the logic they can do (they would become a dumb proxy), similar to why Google hasn't gone E2E.
  - JumpCrisscross 9y ago
    > E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack As I said, not every communication mode must be secure. Slack trades off security for other features, and that is okay. It's odd for Slack to be beating their chest, however, about staying secure when security is not a feature they optimize for.

pfarnsworth 9y ago

How hard would it be for the Russian or Chinese governments to install one of their top programmers into a high-value target like Google, Facebook, Slack, etc and have them introduce subtle bugs that could be used to crack into the private data? If they're not doing this right now I would be shocked.

Spooky23 9y ago

I think that’s an extreme position that priorities some platonic ideal over form, function and utility. It’s certainly reasonable to expect a platform owner to be able to control access and integrity of customer data without encryption, for many use cases.