News for hackers. Stuff that matters.

A comment on Hackers used Slack to break into EA Games. Parent comment

Re:Hackers used Slack to break into EA Games by Ueland on Friday June 11, 2021 @04:24PM (#27478006)
Session invalidation time is someting the slack admin (That is, EA in this case) configures themself.

Fun fact, if you want SSO for your Slack, you have to pay extra unless you are already using one of the top tier Slack editions. So either pay up, or have multiple ways of administering your users, with the security implications that causes.

[ Parent | on HN ]
Re:Hackers used Slack to break into EA Games by whydoyoucare on Friday June 11, 2021 @05:24PM (#27478688)
I've rarely seen any enterprise Slack ever configured for session timeouts. Misplaced trust on the employee device combined with convenience over security.
[ Parent | on HN ]