7 ms·

I just realized that any facebook user can signup on https://facebook.slack.com/ https://facebook.slack.com/ with his fb username.

junto 12y ago
And this is why you should silo customer domains from internal domains as github did (smartly)!
- jdkanani 12y ago
  Github has already faced this issue and homakov[1] pointed that out. [1] https://news.ycombinator.com/user?id=homakov https://news.ycombinator.com/user?id=homakov
- fidz 12y ago
  I am curious. Could you elaborate on this? Edit: I wonder how Github distinguish their own "internal" email doing.
  - rbinv 12y ago
    Well, this flaw is one example: Slack assumes that someone with an @facebook.com email address must be a Facebook employee. However, Facebook issues @facebook.com email addresses to regular users, too.
- jfroma 12y ago
  Facebook might have a directory of employees, ldap or something. Too bad slack doesn't support any of this. This is the price they have to pay for reinventing username and password authentication and requiring everyone to register. It is also bad since employees quit or are fired, and you don't want to have to maintain a directory of employees on every application you use. Shameless plug, I work for https://auth0.com https://auth0.com and we make this easier.
  - ZoFreX 12y ago
    In their defence, Slack does have that as a "coming soon" for their enterprise version.
Jamie452 12y ago
I'm too scared to try it - I have all my photos and stuff like that on my Facebook account. So tempting though!
- sdfjkl 12y ago
  If you trusted Facebook with that, you aren't scared enough.
- merrua 12y ago
  You should backup those off facebook. However consider carefully if you wish to keep that backup in the cloud. (and which cloud).
praseodym 12y ago
Signup confirmation mail doesn't seem to arrive, maybe Facebook was quick to add a filter for mails coming from Slack.
- jdkanani 12y ago
  You first have to enable your facebook email address from facebook email settings.
stephenc_c_ 12y ago
Don't Facebook employees use @fb.com addresses though?
- ZoFreX 12y ago
  Yes, they do.

junto 12y ago

And this is why you should silo customer domains from internal domains as github did (smartly)!

jdkanani 12y ago
Github has already faced this issue and homakov[1] pointed that out. [1] https://news.ycombinator.com/user?id=homakov https://news.ycombinator.com/user?id=homakov
fidz 12y ago
I am curious. Could you elaborate on this? Edit: I wonder how Github distinguish their own "internal" email doing.
- rbinv 12y ago
  Well, this flaw is one example: Slack assumes that someone with an @facebook.com email address must be a Facebook employee. However, Facebook issues @facebook.com email addresses to regular users, too.
jfroma 12y ago
Facebook might have a directory of employees, ldap or something. Too bad slack doesn't support any of this. This is the price they have to pay for reinventing username and password authentication and requiring everyone to register. It is also bad since employees quit or are fired, and you don't want to have to maintain a directory of employees on every application you use. Shameless plug, I work for https://auth0.com https://auth0.com and we make this easier.
- ZoFreX 12y ago
  In their defence, Slack does have that as a "coming soon" for their enterprise version.

Jamie452 12y ago

I'm too scared to try it - I have all my photos and stuff like that on my Facebook account. So tempting though!

sdfjkl 12y ago
If you trusted Facebook with that, you aren't scared enough.
merrua 12y ago
You should backup those off facebook. However consider carefully if you wish to keep that backup in the cloud. (and which cloud).

praseodym 12y ago

Signup confirmation mail doesn't seem to arrive, maybe Facebook was quick to add a filter for mails coming from Slack.

jdkanani 12y ago
You first have to enable your facebook email address from facebook email settings.

stephenc_c_ 12y ago

Don't Facebook employees use @fb.com addresses though?

ZoFreX 12y ago
Yes, they do.