News for hackers. Stuff that matters.

A comment on Ask HN: If your company cares about security, why does it use Slack?. Parent comment

Re:Ask HN: If your company cares about security, why does it... by count on Wednesday June 28, 2017 @01:07PM (#14655932)
You should look again:

https://slack.com/security

[ Parent | on HN ]
Re:Ask HN: If your company cares about security, why does it... by falcolas on Wednesday June 28, 2017 @01:17PM (#14656050)
OK: Slack is not currently a PCI-certified Service Provider.

I was also a bit surprised what they consider out of scope for their bug bounty program: https://hackerone.com/slack

[ Parent | on HN ]
Re:Ask HN: If your company cares about security, why does it... by count on Wednesday June 28, 2017 @01:20PM (#14656091)
I can't begin to fathom a use case for slack where you would put card data in the system...
[ Parent | on HN ]
Re:Ask HN: If your company cares about security, why does it... by fweespeech on Wednesday June 28, 2017 @01:30PM (#14656202)
You've never met a call center.

They've sent bug reports with credit card data they've typed in during a phone call through a variety of insecure methods.

They've also written people's credit card info on sticky notes.

Trust me, the horror that is card data and a call center is scary.

[ Parent | on HN ]
Re:Ask HN: If your company cares about security, why does it... by falcolas on Wednesday June 28, 2017 @01:23PM (#14656117)
How about a bug report screen shot? Lots of non-security conscious users don't understand why this could be bad. It's your (making the assumption that "you" in this case is a Slack Administrator) job to protect them from themselves.
[ Parent | on HN ]
Re:Ask HN: If your company cares about security, why does it... by bogomipz on Wednesday June 28, 2017 @02:14PM (#14656723)
The use case is user error. I have also seen no shortage accidentally people paste passwords into Slack as well
[ Parent | on HN ]