News for hackers. Stuff that matters.

A comment on Wanna know what product your competitor is working on? Try Slack. Parent comment

Re:Wanna know what product your competitor is working on? Tr... by tiglionabbit on Wednesday October 08, 2014 @05:24AM (#8426027)
This is hardly an exploit. Since no authentication is required in order to see the chatroom listings for any domain, we must assume that they meant for their chatroom directory to be public information. This may not be what their customers are expecting, though...
[ Parent | on HN ]
Re:Wanna know what product your competitor is working on? Tr... by ZoFreX on Wednesday October 08, 2014 @07:19AM (#8426305)
It's not listing chatrooms, it's listing teams. Very different. For example, at the company I work we have two teams on Slack: Engineering and Marketing. Not really a problem if people find out that! The channel listing would potentially be more interesting, and this exploit does not allow you to see that (spoilers: it's "general", "random", and "cats").
[ Parent | on HN ]
Re:Wanna know what product your competitor is working on? Tr... by spacefight on Wednesday October 08, 2014 @08:18AM (#8426483)
It's information disclosure at its finest. Something you _really_ want to avoid in a sensitive environment - which company internal comms certainly is.
[ Parent | on HN ]
Re:Wanna know what product your competitor is working on? Tr... by thecus on Wednesday October 08, 2014 @12:48PM (#8427884)
It's a minor degree of information disclosure -- hardly at it's finest.
[ Parent | on HN ]