News for hackers. Stuff that matters.
Re:Slack was hacked by jxm262 on Friday March 27, 2015 @12:50PM (#9277420)
Agreed. The content of the chat's would be potentially much more important in my mind.
Re:Slack was hacked by hazelnut on Friday March 27, 2015 @12:53PM (#9277441)
Which leads to the question if slack encrypts the chat data in the database.
Re:Slack was hacked by mateuszf on Friday March 27, 2015 @12:57PM (#9277487)
That would make implementing search quite hard so I'd say - it's pretty likely they don't encrypt it.
Re:Slack was hacked by smt88 on Friday March 27, 2015 @01:43PM (#9277843)
If anyone from Slack is reading this, the encryption should be an option, even if it means disabling or substantially slowing the search feature.
Re:Slack was hacked by NeutronBoy on Friday March 27, 2015 @06:59PM (#9279608)
If they encrypted it, Slack would have to hold the key, so that all users in an org can then read existing messages.
Re:Slack was hacked by smt88 on Saturday March 28, 2015 @06:42PM (#9283047)
No, it could be a private key shared among users.
Re:Slack was hacked by newobj on Friday March 27, 2015 @08:01PM (#9279834)
That's not right. There is no need to store text body in order to index it. Furthermore, you can implement an index of token hashes, rather than an index of tokens.
Re:Slack was hacked by polyfractal on Friday March 27, 2015 @08:52PM (#9280007)
It would remove a lot of nice search features, however. If you just index tokens without positional information, you have a much harder time performing phrase matching. If you include positional information, you can probably crack the encryption because some tokens are statistically more likely to appear next to each other than others.

If you index shingles (phrase chunks) instead, you lose out on sloppy phrases...you can only match exact phrases. I imagine you can perform a similar statistical attack too.

Hell, just getting the term dictionary would probably allow you to reverse engineer the tokens, since written language follows a very predictable power law.

Hashing also removes the ability to highlight search results, which significantly degrades search functionality for an end user.

Basically, yes, you can do search with encrypted tokens...but it will be a very poor search experience.

Re:Slack was hacked by sukilot on Saturday March 28, 2015 @12:18AM (#9280496)
If they dont encrypt storage they are highly negligent. Index and search are done in RAM,which is slightly harder to steal than disk data.
Re:Slack was hacked by skatenerd on Friday March 27, 2015 @11:28PM (#9280392)
This reminds me of the plot of Silicon Valley
Re:Slack was hacked by jacquesm on Friday March 27, 2015 @02:09PM (#9278036)
Is there a good reason to keep chat data longer than it takes to deliver it to the recipient?
Re:Slack was hacked by buttsex on Friday March 27, 2015 @02:16PM (#9278088)
They archive chat messages so that you can search through them later.
Re:Slack was hacked by jacquesm on Friday March 27, 2015 @02:16PM (#9278094)
That alone would be a great reason not to use them.
Re:Slack was hacked by LaurentVB on Friday March 27, 2015 @02:51PM (#9278312)
It's also a great reason to use them, isn't it? Your searchable chat history basically becomes the knowledge base of your company.
Re:Slack was hacked by gaadd33 on Friday March 27, 2015 @04:44PM (#9278874)
And a great target for discovery in any sort of lawsuit.
Re:Slack was hacked by brandon272 on Friday March 27, 2015 @08:34PM (#9279945)
As is email.
Re:Slack was hacked by ncza on Friday March 27, 2015 @08:33PM (#9279942)
To me, that is something that you should keep internal, on internal systems with vetted free software.
Re:Slack was hacked by jsmeaton on Friday March 27, 2015 @08:12PM (#9279866)
https://slack.zendesk.com/hc/en-us/articles/203457187-Settin...

It's configurable for paid accounts, and can be set as low as one day. However, one of the best features of slack (and products like slack) is message history and search. Otherwise, IRC isn't all that different (WRT messaging).

Re:Slack was hacked by brackin on Friday March 27, 2015 @04:37PM (#9278833)
It's why I love Slack. If I remember a conversation about something two months ago I go to the room, search and find exactly what I needed.
Re:Slack was hacked by higherpurpose on Friday March 27, 2015 @01:36PM (#9277797)
Maybe it's time for Slack to adopt the Axolotl ratchet, too.
Re:Slack was hacked by smerritt on Friday March 27, 2015 @03:25PM (#9278490)
I'd love for them to do that, but there's a couple of problems that they'd have to overcome first.

First: Slackbot. This is a Slack-run bot that's in every channel; team owners can customize it to do various things, like scan messages for keywords and give out canned responses. Even if Slack adopted some variant of encrypted chat, each message would still need to be readable by Slackbot, so Slack would still have the means to collect every message.

Second: channel history. When I join a channel, I can see the messages in that channel from before I joined. This means that Slack (the server) must be able to give me those historical messages. In an encrypted group chat, the messages are encrypted only with the keys of the participants at that time, which means newcomers can't read them.

I'm sure there are other features in conflict with end-to-end encryption, too; these are just off the top of my head.

Re:Slack was hacked by icebraining on Saturday March 28, 2015 @02:32PM (#9282281)
The first could be solved by having the activation part of the bot run on the clients themselves, and only send those messages in a readable way to the server.

As for the second, the server could ask one of the clients to re-encrypt the channel history with the newcomer's key. It would only fail if nobody was online the moment you joined the channel (and you still could get it later).