>The attackers also inserted code that allowed them to capture plaintext passwords as they were entered by users at the time. >Today we are resetting passwords

>The attackers also inserted code that allowed them to capture plaintext passwords as they were entered by users at the time. >Today we are resetting passwords for all accounts that were active at the time of the 2015 incident Ok so Slack's security is still dependent on the (unrealistic) hope that their authentication-receiving process isn't manipulable and nothing has changed. I.e. "we are very sorry, we are praying this doesn't happen again" It would be better if their authentication-receiving process wasn't dependent on being not manipulable through a "Password-authenticated key agreement" PAKE: https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr... >irreversibly encrypted, or “hashed,” passwords Please, don't describe hashes inaccurately as enciphering information. "Scrambled" is marketable enough.