5 ms·

I'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions a

I'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions and business secrets... if that floodgate ever opens then it will be a crazy time for us devs!

alexandercrohde 8y ago
Just as a heads up on this, slack doesn't even use HTTPS! Your employer can certainly read all private slacks on your work network, even if it's a non-work-slack workspace
- ninkendo 8y ago
  Do you have a source for this? That sounds very surprising if true.
- teraflop 8y ago
  This is absolutely not true, as a cursory examination of your browser's dev tools will reveal.
- ReidZB 8y ago
  Pretty sure it uses HTTPS, but if you're on a corporate network on corporate hardware, there is a real chance that there's a corporate MITM proxy that is capable of reading all of your HTTPS traffic.
  - isostatic 8y ago
    Only if you have their root certificate trusted
    - maxxxxx 8y ago
      You have to do that if you want to do any work.
    - doesnt_know 8y ago
      From experience, if the org is doing https mitm then it almost certainly also has network device authentication (eg Cisco ICE) that would only allow corporate whitelisted devices. Usually with custom builds that would already have the corp root cert trusted.
- judge2020 8y ago
  curl http://slack.com -v < HTTP/1.1 302 Found < location: https://slack.com/
wool_gather 8y ago
Yeah, this drives me up a wall. I have a coworker who constantly champions the bull* static code analyzer we use catching "security" issues...and then sends around certs and keys via Slack and email. :/
enraged_camel 8y ago
Security is always a matter of cost vs. benefit, i.e. you need to weigh the cost of the risk (likelihood * impact) with the benefit of the action. For example, I have shared credentials on Slack before, but that's because said credentials were for a non-critical system, and if hackers somehow a) hacked Slack and b) identified the information I shared and used it, the only thing they would get their hands on would be a curated collection of cat pictures with funny captions (and I don't re-use passwords). Therefore, blanket rules like "don't share credentials on Slack" tend to miss the point. Obviously, don't share your bank account info on there. But you can totally talk about otherwise sensitive stuff if the risk profile is sufficiently negligible.
- TeMPOraL 8y ago
  Sharing credentials is not a problem. The more critical ones are probably rotated regularly anyway. But it'll be fun to see all the dirty laundry getting aired publicly if and when Slack gets hacked.
leppr 8y ago
Good time to remind that hacks notwithstanding, Slack private messages can in many occasions not be private by design (and so shouldn't be considered private to begin with): https://mashable.com/2017/10/26/slack-dms-private https://mashable.com/2017/10/26/slack-dms-private

alexandercrohde 8y ago

Just as a heads up on this, slack doesn't even use HTTPS! Your employer can certainly read all private slacks on your work network, even if it's a non-work-slack workspace

ninkendo 8y ago
Do you have a source for this? That sounds very surprising if true.
teraflop 8y ago
This is absolutely not true, as a cursory examination of your browser's dev tools will reveal.
ReidZB 8y ago
Pretty sure it uses HTTPS, but if you're on a corporate network on corporate hardware, there is a real chance that there's a corporate MITM proxy that is capable of reading all of your HTTPS traffic.
- isostatic 8y ago
  Only if you have their root certificate trusted
  - maxxxxx 8y ago
    You have to do that if you want to do any work.
  - doesnt_know 8y ago
    From experience, if the org is doing https mitm then it almost certainly also has network device authentication (eg Cisco ICE) that would only allow corporate whitelisted devices. Usually with custom builds that would already have the corp root cert trusted.
judge2020 8y ago
curl http://slack.com -v < HTTP/1.1 302 Found < location: https://slack.com/

wool_gather 8y ago

Yeah, this drives me up a wall. I have a coworker who constantly champions the bull* static code analyzer we use catching "security" issues...and then sends around certs and keys via Slack and email. :/

enraged_camel 8y ago

Security is always a matter of cost vs. benefit, i.e. you need to weigh the cost of the risk (likelihood * impact) with the benefit of the action. For example, I have shared credentials on Slack before, but that's because said credentials were for a non-critical system, and if hackers somehow a) hacked Slack and b) identified the information I shared and used it, the only thing they would get their hands on would be a curated collection of cat pictures with funny captions (and I don't re-use passwords). Therefore, blanket rules like "don't share credentials on Slack" tend to miss the point. Obviously, don't share your bank account info on there. But you can totally talk about otherwise sensitive stuff if the risk profile is sufficiently negligible.

TeMPOraL 8y ago
Sharing credentials is not a problem. The more critical ones are probably rotated regularly anyway. But it'll be fun to see all the dirty laundry getting aired publicly if and when Slack gets hacked.

leppr 8y ago

Good time to remind that hacks notwithstanding, Slack private messages can in many occasions not be private by design (and so shouldn't be considered private to begin with): https://mashable.com/2017/10/26/slack-dms-private https://mashable.com/2017/10/26/slack-dms-private