News for hackers. Stuff that matters.

A comment on Salesforce is shuttering Slack’s remote work research group Future Forum. Parent comment

Re:Salesforce is shuttering Slack’s remote work research gro... by pid-1 on Saturday April 01, 2023 @12:06PM (#35401362)
How do you deal with security?

- No SSO

- No way to enforce MFA, restrict logins to trusted devices and IPs, etc...

- No message / audit logs

I like discord for personal use, no way I would use it professionally

[ Parent | on HN ]
Re:Salesforce is shuttering Slack’s remote work research gro... by DANmode on Saturday April 01, 2023 @12:20PM (#35401475)
There's no way to enforce MFA? How do you figure?

Give new users a very short window, or not able to use until their hardware key, phone enclave, etc is registered for MFA.

You could even go as far as to send pre-registered hardware keys by mail, or have them picked up from HQ upon hire.

Certainly would have solved some of the recent "who actually works in infra at Twitter" debacle, now that I'm thinking about it.

[ Parent | on HN ]
Re:Salesforce is shuttering Slack’s remote work research gro... by xxpor on Saturday April 01, 2023 @12:27PM (#35401551)
That's how you get people to use MFA, but AFAIK there's no feature in Discord to a) federate with a directory like AD or b) force users on a server to only be able to sign in with a hw key
[ Parent | on HN ]
Re:Salesforce is shuttering Slack’s remote work research gro... by pid-1 on Saturday April 01, 2023 @01:02PM (#35401885)
How do you know folks are using their hw keys to log in discord?
[ Parent | on HN ]