3 ms·
I am not a lawyer and this is not legal advice. But it could be. It's actually worse than what you described. By default, users can install integrations and
by LinuxBender 8y ago
I am not a lawyer and this is not legal advice. But it could be.
It's actually worse than what you described. By default, users can install integrations and applications that extend legal contract of your company to fly-by-night third parties that can obtain access to all public channels that any user of their integration is a member of. We locked this down, but most companies don't realize the legal, privacy and security risks they are accepting.
So Slack itself does not need to get hacked by anyone. The framework by design facilitates this and removes Slack from legal responsibility. Your organization takes on this legal risk and the users in your org decide your legal fate (unless you lock down integration / third party apps). I mention legal fate, as many companies are using Slack for ChatOps, automation, discussing customer issues and much more.
- Rjevski 8y agoI’m not sure how is this different from an employee copy/pasting confidential data in an email and sending it off to a third-party. Will you also blame email clients for making it “too easy” to leak data to third parties?
- LinuxBender 8y agoThis is not about me blaming anyone. This is about educating folks that the shiny new "app" they installed is relaying data to a 3rd party and it may not be clear to people the legal and privacy ramifications of doing so. They must also be made aware that the 3rd party has no legal agreement with them so they are dealing with 3rd party data processors. I can assure you that most legal and HR departments have no idea that Slack does this.