3 ms·
Well, since the user was able to gain access with a stolen cookie, these things are possibly true: 1) Slack does not invalidate sessions after a short enough p
by grumple 5y ago
Well, since the user was able to gain access with a stolen cookie, these things are possibly true:
1) Slack does not invalidate sessions after a short enough period of time or inactivity (for a cookie to make it to another site, be purchased and used, probably takes some time).
2) Slack does not properly terminate sessions on logout or inactivity (allowing cookies to be reused after logout).
3) Slack is not using any more clever techniques to make cookies useless to attackers.
- Ueland 5y agoSession invalidation time is someting the slack admin (That is, EA in this case) configures themself. Fun fact, if you want SSO for your Slack, you have to pay extra unless you are already using one of the top tier Slack editions. So either pay up, or have multiple ways of administering your users, with the security implications that causes.
- whydoyoucare 5y agoI've rarely seen any enterprise Slack ever configured for session timeouts. Misplaced trust on the employee device combined with convenience over security.
- jbkkd 5y agoThis, and especially #3. Having the same cookie used on a different computer should be the reddest flag of them all. This could be identified by the user agent (different version of the Slack client) and a different IP (cookie accessed from a different country than it was originally created).