9 ms·

I’m having trouble fully understanding your argument. Is your argument that all non e2e communication is insecure, or that slack is incompetent? If it’s the for

I’m having trouble fully understanding your argument. Is your argument that all non e2e communication is insecure, or that slack is incompetent? If it’s the former, should I consider tools like Gmail, and the google security infrastructure as security theater? If it’s the latter, then why? The idea that I should expect all my gmail messages to end up in a torrent somewhere is a pretty audacious claim. I don’t pretend to believe that it won’t happen, but if it does, I can’t pretend I would have been more prepared than google when it comes to hosting my own email.

JumpCrisscross 9y ago
> Is your argument that all non e2e communication is insecure I think this. (In the context of a company, communications where the company doesn't hold all the keys.) Insecure modes aren't useless. But they certainly shouldn't be used to share sensitive information.
- codefined 9y ago
  E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack. One of the simplest issues I can see is the search functionality, something I use daily in Slack and would sorely miss not having. Elasticsearch requires access to the contents of a message to index it (basic requirement). Another thing that would become difficult would be adding people to a group, although my technical knowledge in this area is perhaps not massive, my thoughts are that if a user can join a group with another key, surely a Slack attacker would also be able to add their own key? I'm sure there are many other things that ensure Slack cannot be E2E encrypted since it stops a significant amount of the logic they can do (they would become a dumb proxy), similar to why Google hasn't gone E2E.
  - JumpCrisscross 9y ago
    > E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack As I said, not every communication mode must be secure. Slack trades off security for other features, and that is okay. It's odd for Slack to be beating their chest, however, about staying secure when security is not a feature they optimize for.
CaptSpify 9y ago
> If it’s the former, should I consider tools like Gmail, and the google security infrastructure as security theater? Isn't that obviously true? It's clear that your data can be taken from you and sent to whoever they want at any time, all without your knowlede. Either by Google themselves, or a malicious actor who has access to Google's data. How is this not the very definition of insecure? Don't get me wrong, securing your own server isnt for everyone, but Google is an already known compromised system.

JumpCrisscross 9y ago

> Is your argument that all non e2e communication is insecure I think this. (In the context of a company, communications where the company doesn't hold all the keys.) Insecure modes aren't useless. But they certainly shouldn't be used to share sensitive information.

codefined 9y ago
E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack. One of the simplest issues I can see is the search functionality, something I use daily in Slack and would sorely miss not having. Elasticsearch requires access to the contents of a message to index it (basic requirement). Another thing that would become difficult would be adding people to a group, although my technical knowledge in this area is perhaps not massive, my thoughts are that if a user can join a group with another key, surely a Slack attacker would also be able to add their own key? I'm sure there are many other things that ensure Slack cannot be E2E encrypted since it stops a significant amount of the logic they can do (they would become a dumb proxy), similar to why Google hasn't gone E2E.
- JumpCrisscross 9y ago
  > E2E encryption fails on a large number of subjects when it comes to a chat application such as Slack As I said, not every communication mode must be secure. Slack trades off security for other features, and that is okay. It's odd for Slack to be beating their chest, however, about staying secure when security is not a feature they optimize for.

CaptSpify 9y ago

> If it’s the former, should I consider tools like Gmail, and the google security infrastructure as security theater? Isn't that obviously true? It's clear that your data can be taken from you and sent to whoever they want at any time, all without your knowlede. Either by Google themselves, or a malicious actor who has access to Google's data. How is this not the very definition of insecure? Don't get me wrong, securing your own server isnt for everyone, but Google is an already known compromised system.