Hacker News Reader

Comment by ltbarcly3 | Hacker News Reader

What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked? I guess those things aren't trendy enough to worry about.

For a long time I have noticed what I would call 'ankle biting journalism'. Basically take whatever is trendy, make only the most obvious observations about it (things that someone who only rudimentary knowledge would come up with in a few minutes), then act like these obvious things are serious and there is a problem here.

As usual, it's not that serious, and there isn't a problem here. I have no idea how Slack stores user chat history, but lets say they store them in plain text in the cloud. Then Slack is about as secure as IRC, which is exactly what it is trying to be, IRC 'but better'.

Besides, if you are using Slack for work, whoever is the 'Owner' of the enterprise account can export and view every conversation whenever they want, because 'compliance'.

View on HN

"In hindsight, complying with the company's Document Retention Policy (which at Netscape was basically, ``shred anything within 90 days unless you can't get your job done without it'') might have been a good idea." [1]

Do companies no longer have Document Retention Policies? That seems like the bigger piece of the story here.

[1] https://www.jwz.org/gruntle/rbarip.html

FYI if you're referred from hackernews and have never visited the site before, the jwz links redirect to (somewhat nsfw: photoshopped testicle in an egg cup) http://i.imgur.com/32R3qLv.png.

It depends on the information that’s flowing in them. If they are under compliance purview then they might have to retain or at least archive years worth of information.

Netscape was before Sarbanes-Oxley though, which mandates extensive retention policies for business communication.

> What if all your search history were leaked? What if all your text messages were leaked? What if all your emails were leaked?

But I can directly go into all those things and delete at least my copies of them. Even with as many problems as Google and Facebook have, it's relatively straightforward to see the entire history of what I have on their sites and delete it.

> As usual, it's not that serious, and there isn't a problem here.

Quoth the article,

> Everything beyond that 10,000-message limit remains on Slack’s servers. So while those messages might seem out of sight and out of mind, they are all still indefinitely available to Slack, law enforcement and third-party hackers.

So I can't go back and check those on any free Slack server I post on.

And if someone decides to pay Slack for one of those servers, blam, any convo that got heated but that I forgot about is now visible to anyone with an axe to grind.

We've seen 10 year old tweets dredged up to go after people of all stripes, so this is certainly a thing that happens.

No, you absolutely can't delete your search history, which Google stores in perpetuity, and you can't delete the copies of your SMS messages that sit on some server somewhere, probably forever. All you can do is make it inaccessible in the app or web page you as the user can view it from.

There are two distinct threat levels:

1. the mostly anonymized logs that require a technically difficult crack and would impact many thousands (millions?) of people simultaneously.

2. activity that can be tied directly back to individuals by anyone with time on their hands.

You're absolutely right that there are servers maintaining logs and such, that aren't accessible, but they fall into #1. And category #1 can happen, the famous cheating website being cracked as a great example. But that was itself relatively exceptional since simply being a user was enough to end in divorce.

The Slack message history distinctly falls into #2. It's a far more immediate problem.

Everything they have published shows that you can delete search history, among other things. They recently released a feature which is effectively a TTL on searches, for retention purposes.

The problem you mention is different, and the severity is as high as the most sensitive content that's been posted.

As is the case with most chat platforms, the technical safeties put in place only serve to protect _legitimate_ users. The problem you're referring to is a matter of _illegitimate_ users or _insider-threats_.

* What if I copy-paste a sensitive conversation to a third-party?

* What if I export conversations or user accounts to a third-party?

* What if I grant an unauthorized party access to a conversation that they wouldn't otherwise be able to see?

In-transit encryption and encrypted storage do not solve these issues, because an insider threat inititated the action.

Since when is not encrypting what could be sensitive communication ""isn't a problem here"?

Edit: I should have pointed out that the article doesn't say they don't encrypt the data, it just says they don't end-to-end encrypt it, which by definition would require it to be impossible for Slack or anyone else to read the messages (other than the users who sent them or were in the channel at the time they were sent). Only a handful or recent apps like Signal and Telegram even attempt to do this.

Any form of communication (or really any form of information storage) could be sensitive, that's my point exactly. There's literally no reason to mention Slack other than it's hot and the author could glom onto a trendy brand name to get people to read an article that is basically devoid of any novel content.

If a new sport which merges football, basketball, and chess become popular, we would see a bunch of articles 'People Who Play Chessketball are Getting Injured'. 'Chessketball has an Injury Problem'. 'Things you Need to Know before you Let Your Children Play Chessketball' Yes, people are more likely to be injured whenever they participate in any physical activity. Also when they ride a bike or go for a jog. Also, it turns out, if they don't do any physical activity at all they will suffer from heart disease.

I think the fact that Slack communication isn't encrypted is a valid news article.

I don't think that because the topic is "hot" that makes talking about it "no reason other than".

I feel like there is a surprising volume of "oh man why did the author bring this up" type posts on HN, I don't get it. The topic seems valid.

Exactly, there is no good reason why Slack doesn't at least provide the option to end to end encrypt conversations.

I hope that stories like this continue so that e2e encryption is supported by any messaging platform that wants to be taken seriously.

So, I think this is a problem and that encryption and data security policies and audits would be a good thing. But your parent's point also resonated with me. This isn't a shocking expose of some giant new problem. Protecting proprietary communication has been a problem for as long as organizations have existed. It was a problem when the solution at Los Alamos was safes in offices, it was a problem with memos, it was a problem with faxes, then emails, and now, yes, Slack chats. It's a problem, people should work on it, but it's not news.

What qualifies as news?

Does it have to be " a shocking expose"?

All the things you mentioned about communication seem to apply to this article.

I mean, this is a good philosophical question, and I think the answer tends to just be "whatever a news organization decides to write about", so clearly this counts.

But I think what makes for interesting news are things that are new and non-obvious. The point of the thread starter (which resonated with me) is that this is neither. What rubs me wrong about the article is that it lacks context. From just this article, this sounds like a novel threat. But it's ludicrously far from that. You could write the same article about every communication system used by every business ever. For instance, tons of important stuff is still required to be done by fax, which is far less privacy-preserving than Slack. Email remains pretty much universally unencrypted.

The article doesn't try to grapple with this context at all, which makes it read oddly to me.

> Then Slack is about as secure as IRC, which is exactly what it is trying to be, IRC 'but better'.

Anything I write on IRC I assume is public. Not so with Slack, where much is written in DMs.

The email comparison is more apt.

What you say is all true, but some kind of end to end encryption would reduce the risk, or at-least impede mass leaking of data. That seems to be the entire point of the article.

I would assume this article was "paid for" (perhaps not directly) by someone with a vested interest. E.g. a competitive vendor with a better security story, or whoever is having their legacy lunch eaten by Slack.

Reply on news.ycombinator.com