4 ms·

>All it takes is for a admin (or hacked admin account) to change the password of the target slack user and login as said user to view all their private messages

>All it takes is for a admin (or hacked admin account) to change the password of the target slack user and login as said user to view all their private messages. An admin cannot change a user's password. You can enable an account wide feature which allows admins to view all messages but that's separate and costs money. Also not what you described.

geofft 8y ago
If you're using SSO, which almost every big customer does, you can usually do a password reset in the SSO itself. Also I'm pretty sure a Slack admin can change a user's email address, at which point they can trigger a password reset.
- ds 8y ago
  bingo. The admin just changes the email address than does a forgot password recovery. This works without SSO/special integrations. You can do this on a vanilla slack install to any user.
- ec109685 8y ago
  It does email the person you made the change though. If you control the email system, then you could do it silently.
jrockway 8y ago
I don't think that's true. In the corporate world, Slack is authenticated with AD/SAML/etc. and Slack has no idea who is changing passwords on that backend system. The reality is that IT administrators are the root of trust at all organizations. This new feature doesn't change that.
- bookofjoe 8y ago
  >The reality is that IT administrators are the root of trust at all organizations. Is this true?
  - ryukafalz 8y ago
    From a technical perspective, yes, though of course not a legal perspective. Take certs signed by an internal CA for example; as far as end user devices are concerned, the root of trust is that CA, which is presumably configured and managed by your IT staff. (Or sysadmins or whatever the role happens to be at your company.) It’s of course possible to limit administrators’ access to certain systems, but ultimately the mechanisms to do so are themselves probably set up by your IT administrators in the first place, so in that sense they’re still the root of trust.
- mistrial9 8y ago
  IT administrators may handle the root of trust, but IT administrators are closely subservient to management. Management, in the business of control, knows this, and pushes at many opportunities. In the US courts, management whim controls any asset, not de-facto key holders.
- ds 8y ago
  The admin just changes the email address than does a forgot password recovery. You dont need SSO/special integrations. You can do this on a vanilla slack install to any user.

geofft 8y ago

If you're using SSO, which almost every big customer does, you can usually do a password reset in the SSO itself. Also I'm pretty sure a Slack admin can change a user's email address, at which point they can trigger a password reset.

ds 8y ago
bingo. The admin just changes the email address than does a forgot password recovery. This works without SSO/special integrations. You can do this on a vanilla slack install to any user.
ec109685 8y ago
It does email the person you made the change though. If you control the email system, then you could do it silently.

jrockway 8y ago

I don't think that's true. In the corporate world, Slack is authenticated with AD/SAML/etc. and Slack has no idea who is changing passwords on that backend system. The reality is that IT administrators are the root of trust at all organizations. This new feature doesn't change that.

bookofjoe 8y ago
>The reality is that IT administrators are the root of trust at all organizations. Is this true?
- ryukafalz 8y ago
  From a technical perspective, yes, though of course not a legal perspective. Take certs signed by an internal CA for example; as far as end user devices are concerned, the root of trust is that CA, which is presumably configured and managed by your IT staff. (Or sysadmins or whatever the role happens to be at your company.) It’s of course possible to limit administrators’ access to certain systems, but ultimately the mechanisms to do so are themselves probably set up by your IT administrators in the first place, so in that sense they’re still the root of trust.
mistrial9 8y ago
IT administrators may handle the root of trust, but IT administrators are closely subservient to management. Management, in the business of control, knows this, and pushes at many opportunities. In the US courts, management whim controls any asset, not de-facto key holders.
ds 8y ago
The admin just changes the email address than does a forgot password recovery. You dont need SSO/special integrations. You can do this on a vanilla slack install to any user.