Hacker News Reader

hmm a lot of online services have smart to detect suspicious connections, even if you have q cookie. even something as simple as verifying the geo of the IP and client type couldve been useful here. im not sure if slack has this funcionality

View on HN

Pretty trivial to route your request through an IP address in the same city as the victim.

Possible, but not exactly trivial to do the same with an IP address in the same city and from the same ASN as the impersonation victim.

There are definitely some mitigations you can do servers use to reduce the likelihood of success of this kind of attack.

Now I want to go build an auth system. :D

How would mobile networks fair with something like this if youre moving around?

Plenty of webapps already do this. You'll usually get asked to re-login or to provide a 2fa code to proceed. Very annoying when you hop between networks often.

Slack has an audit trail for some accesses, at the least, so EA could have done the GEOIP on their side.

Reply on news.ycombinator.com