5 ms·

Why can't the recipient save a copy of logs?

by fjsolwmv 9y ago

sliken 9y ago
Because they typically can be easily falsified.
- antris 9y ago
  You could have the logs signed with Slack's PGP key so they cannot be altered without the signature causing a mismatch.
  - IncRnd 9y ago
    There are security issues here that you may not be aware. For one example, if technically knowledgeable people want to falsify signed logs without having the signing key, they can simply keep a separate set of logs with actual innocuous conversations. Slack would sign those in your scenario without a problem. This is the canonical problem of keeping "double-books".
    - dsacco 9y ago
      While I agree with auditable access to employee DMs, there is a middle ground solution that trivially solves the problem you've presented. Instead of providing the employer with access to the employee's messages directly, logs can be signed at both the blob and message level. Then if an employee selectively turns over only some of their logs, the mismatch will be readily apparent.
      - dlubarov 9y ago
        Not sure what you mean by blobs? If Slack implemented a scheme like this, they should sign a message which includes metadata like the org name, channel name and timestamps in addition to text.
        dsacco 9y ago
        By blob I mean an archive dump of every message and the metadata you're describing. If that dump is hashed, selectively presenting messages in the dump is obvious.
      - IncRnd 9y ago
        Of course it can be solved! I was pointing out that the prior comment was incorrect. If an employee is in possession of chat logs that if divulged will get them fired, they can simply delete the logs. "Sorry, the drive crashed. IT is working to fix it right now." Stepwise refinement to insecurely re-create security solutions is one of the reasons for many security vulnerabilities. Logs are well understood, and logging of sensitive information is not just a small technical issue but a security issue. The same way that people shouldn't design their own crypto, when people design logging mechanisms for sensitive data, which is seemingly simple, they will almost always introduce these security errors, as in your post. Unfortunately, there are also a number of legal issues (and possibly compliance issues) that need to be accounted for from redaction to anonymity and from GDPR to encryption.
  - simias 9y ago
    Arguably, but what if the company wants to find proof of, say, two employees colluding to exfiltrate sensitive data or something like that? Would they have to convince them to turn in the PGP signed logs? More generally like the parent I don't see why a company couldn't have full control over their corporate tools.
    - pera 9y ago
      > two employees colluding to exfiltrate sensitive data or something like that In that case spying Slack usage is simply not enough: the employer should need to spy every single move every employee makes inside and outside the company, which of course it's not possible (well, except if the company is located in a fascist state).
      - stale2002 9y ago
        Not everybody is going to send one time pad private key encrypted messages using a 1000 characater password. It turns out that having access to slack alone would probably catch 95% of situations.
    - mistercow 9y ago
      What if those two employees collude to do something like that via their own private phones? Should employers have access to those too? It doesn't seem to me like any of this really does anything, since there are (and should be) plenty of ways that employees can communicate without their employer having access.
IncRnd 9y ago
You need non-repudiation of changes to log contents.
jerf 9y ago
Provenance. I can doctor my local logs just about as quickly as I can type. True, it's a bit harder than some people estimate to keep the whole thing coherent, but that just means that you hear about the people who get caught, but not the ones who do it successfully. If I am capable of doctoring Slack's copy of the logs with sufficient effort, it is certainly orders of magnitude harder and much legally riskier (as I would be committing many felonies in the process).
- darawk 9y ago
  That's easy to disprove, though. Make them log into their slack on a new computer, and they'll have no opportunity to doctor them.
  - stedaniels 9y ago
    It's got enterprise auth, they could just as easily login to the Slack account themselves. ¯\_(ツ)_/¯
  - jerf 9y ago
    The parent I was replying to said they ought to keep the Slack logs themselves. If they're logging into Slack to get them, then it is Slack doing the keeping and we're back to Slack doing the storage.
dsacco 9y ago
What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? If any employee can ostensibly be compelled to provide their logs when asked by their employer, you are getting just as much information as if IT can view them directly. The only way IT doesn't get as much information is if the system doesn't work, for example because employees can alter their logs or simply refuse to provide them. In that scenario having employees saving their own logs gives you more privacy, but doesn't solve the essential problem. The tradeoff here is convenience of access versus friction. When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it.
- afastow 9y ago
  > What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? > When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it. You just answered your own question. You might not want them to know you're reviewing it but they most certainly do want to know that you are.
  - dsacco 9y ago
    > You might not want them to know you're reviewing it but they most certainly do want to know that you are. Of course they want to know. Everyone wants to know. But if they committed a crime, or at least are complicit in a lawsuit the company is facing, their desire for privacy on an information channel they don't own is irrelevant. I don't understand why this is controversial. When the SEC, FBI, local police, opposing legal team, etc. want you to hand over information about an employee, having to ask the employee directly or even let them know is problematic.
    - afastow 9y ago
      Maybe I missed some context but since when are we talking about committing crimes and the SEC or FBI getting involved? If it's that serious I assume they'd just get a warrant and get the logs directly from Slack. To me that scenario is completely unrelated to the ability of an employer to silently read DMs of their employees for any reason they see fit.

Why can't the recipient save a copy of logs?

sliken 9y ago

Because they typically can be easily falsified.

antris 9y ago
You could have the logs signed with Slack's PGP key so they cannot be altered without the signature causing a mismatch.
- IncRnd 9y ago
  There are security issues here that you may not be aware. For one example, if technically knowledgeable people want to falsify signed logs without having the signing key, they can simply keep a separate set of logs with actual innocuous conversations. Slack would sign those in your scenario without a problem. This is the canonical problem of keeping "double-books".
  - dsacco 9y ago
    While I agree with auditable access to employee DMs, there is a middle ground solution that trivially solves the problem you've presented. Instead of providing the employer with access to the employee's messages directly, logs can be signed at both the blob and message level. Then if an employee selectively turns over only some of their logs, the mismatch will be readily apparent.
    - dlubarov 9y ago
      Not sure what you mean by blobs? If Slack implemented a scheme like this, they should sign a message which includes metadata like the org name, channel name and timestamps in addition to text.
      - dsacco 9y ago
        By blob I mean an archive dump of every message and the metadata you're describing. If that dump is hashed, selectively presenting messages in the dump is obvious.
    - IncRnd 9y ago
      Of course it can be solved! I was pointing out that the prior comment was incorrect. If an employee is in possession of chat logs that if divulged will get them fired, they can simply delete the logs. "Sorry, the drive crashed. IT is working to fix it right now." Stepwise refinement to insecurely re-create security solutions is one of the reasons for many security vulnerabilities. Logs are well understood, and logging of sensitive information is not just a small technical issue but a security issue. The same way that people shouldn't design their own crypto, when people design logging mechanisms for sensitive data, which is seemingly simple, they will almost always introduce these security errors, as in your post. Unfortunately, there are also a number of legal issues (and possibly compliance issues) that need to be accounted for from redaction to anonymity and from GDPR to encryption.
- simias 9y ago
  Arguably, but what if the company wants to find proof of, say, two employees colluding to exfiltrate sensitive data or something like that? Would they have to convince them to turn in the PGP signed logs? More generally like the parent I don't see why a company couldn't have full control over their corporate tools.
  - pera 9y ago
    > two employees colluding to exfiltrate sensitive data or something like that In that case spying Slack usage is simply not enough: the employer should need to spy every single move every employee makes inside and outside the company, which of course it's not possible (well, except if the company is located in a fascist state).
    - stale2002 9y ago
      Not everybody is going to send one time pad private key encrypted messages using a 1000 characater password. It turns out that having access to slack alone would probably catch 95% of situations.
  - mistercow 9y ago
    What if those two employees collude to do something like that via their own private phones? Should employers have access to those too? It doesn't seem to me like any of this really does anything, since there are (and should be) plenty of ways that employees can communicate without their employer having access.

IncRnd 9y ago

You need non-repudiation of changes to log contents.

jerf 9y ago

Provenance. I can doctor my local logs just about as quickly as I can type. True, it's a bit harder than some people estimate to keep the whole thing coherent, but that just means that you hear about the people who get caught, but not the ones who do it successfully. If I am capable of doctoring Slack's copy of the logs with sufficient effort, it is certainly orders of magnitude harder and much legally riskier (as I would be committing many felonies in the process).

darawk 9y ago
That's easy to disprove, though. Make them log into their slack on a new computer, and they'll have no opportunity to doctor them.
- stedaniels 9y ago
  It's got enterprise auth, they could just as easily login to the Slack account themselves. ¯\_(ツ)_/¯
- jerf 9y ago
  The parent I was replying to said they ought to keep the Slack logs themselves. If they're logging into Slack to get them, then it is Slack doing the keeping and we're back to Slack doing the storage.

dsacco 9y ago

What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? If any employee can ostensibly be compelled to provide their logs when asked by their employer, you are getting just as much information as if IT can view them directly. The only way IT doesn't get as much information is if the system doesn't work, for example because employees can alter their logs or simply refuse to provide them. In that scenario having employees saving their own logs gives you more privacy, but doesn't solve the essential problem. The tradeoff here is convenience of access versus friction. When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it.

afastow 9y ago
> What is the material difference between having employees save DM logs in an auditable, authenticated way and being able to view employee DMs? > When you are reviewing an auditable log of information related to an employee, you don't necessarily want to have to ask the employee for that information, nor do you necessarily want them to know you're reviewing it. You just answered your own question. You might not want them to know you're reviewing it but they most certainly do want to know that you are.
- dsacco 9y ago
  > You might not want them to know you're reviewing it but they most certainly do want to know that you are. Of course they want to know. Everyone wants to know. But if they committed a crime, or at least are complicit in a lawsuit the company is facing, their desire for privacy on an information channel they don't own is irrelevant. I don't understand why this is controversial. When the SEC, FBI, local police, opposing legal team, etc. want you to hand over information about an employee, having to ask the employee directly or even let them know is problematic.
  - afastow 9y ago
    Maybe I missed some context but since when are we talking about committing crimes and the SEC or FBI getting involved? If it's that serious I assume they'd just get a warrant and get the logs directly from Slack. To me that scenario is completely unrelated to the ability of an employer to silently read DMs of their employees for any reason they see fit.