Why Is Slack Retaining Everyone's Chat History? (nytimes.com) 104
The associate director of research at the Electronic Frontier Foundation published a new warning in the Opinion section of the New York Times this week, calling Slack the only unicorn going public this year "that has admitted it is at risk for nation-state attacks" and saying there's a simple way to minimize risk -- that Slack has so far refused to take:
Right now, Slack stores everything you do on its platform by default -- your username and password, every message you've sent, every lunch you've planned and every confidential decision you've made. That data is not end-to-end encrypted, which means Slack can read it, law enforcement can request it, and hackers -- including the nation-state actors highlighted in Slack's S-1 -- can break in and steal it...
Slack's paying enterprise customers do have a way to mitigate their security risk -- they can change their settings to set shorter retention periods and automatically delete old messages -- but it's not just big companies that are at risk... Free customer accounts don't allow for any changes to data retention. Instead, Slack retains all of your messages but makes only the most recent 10,000 visible to you. Everything beyond that 10,000-message limit remains on Slack's servers. So while those messages might seem out of sight and out of mind, they are all still indefinitely available to Slack, law enforcement and third-party hackers...
Slack should give everyone the same privacy protections available to its paying enterprise customers and let all of its users decide for themselves which messages they want to keep and which messages they want to delete. It's undeniably Slack's prerogative to charge for a more advanced product, but making users pay for basic privacy and security protections is the wrong call. It's time for Slack to step up, minimize the amount of sensitive data hanging around on its servers and give all its users retention controls.
The article notes that Slack's stock filings acknowledge that it faces threats from "sophisticated organized crime, nation-state, and nation-state supported actors."
The filings even specifically add that Slack's security measures "may not be sufficient to protect Slack and our internal systems and networks against certain attacks," and that completely eliminating the threat of a nation-state attack would be "virtually impossible."
Right now, Slack stores everything you do on its platform by default -- your username and password, every message you've sent, every lunch you've planned and every confidential decision you've made. That data is not end-to-end encrypted, which means Slack can read it, law enforcement can request it, and hackers -- including the nation-state actors highlighted in Slack's S-1 -- can break in and steal it...
Slack's paying enterprise customers do have a way to mitigate their security risk -- they can change their settings to set shorter retention periods and automatically delete old messages -- but it's not just big companies that are at risk... Free customer accounts don't allow for any changes to data retention. Instead, Slack retains all of your messages but makes only the most recent 10,000 visible to you. Everything beyond that 10,000-message limit remains on Slack's servers. So while those messages might seem out of sight and out of mind, they are all still indefinitely available to Slack, law enforcement and third-party hackers...
Slack should give everyone the same privacy protections available to its paying enterprise customers and let all of its users decide for themselves which messages they want to keep and which messages they want to delete. It's undeniably Slack's prerogative to charge for a more advanced product, but making users pay for basic privacy and security protections is the wrong call. It's time for Slack to step up, minimize the amount of sensitive data hanging around on its servers and give all its users retention controls.
The article notes that Slack's stock filings acknowledge that it faces threats from "sophisticated organized crime, nation-state, and nation-state supported actors."
The filings even specifically add that Slack's security measures "may not be sufficient to protect Slack and our internal systems and networks against certain attacks," and that completely eliminating the threat of a nation-state attack would be "virtually impossible."
For the money (Score:5, Insightful)
Next question?
Re: (Score:2)
Next question?
"Ve haf vays of making you chat!"
Re: For the money (Score:2)
It's true. I've heard the gestapo pays its collaborators well for mass surveillance data.
Because they can (Score:1)
And will mine it to sell to advertisers. Grow up you tards. Its free, meaning you are the product. Shit even if its not free, you are the product
Re: (Score:1)
Did you not read the last sentence, "even if its NOT free, you are the product".
It doesn't fucking matter if you pay. The surveillance-capitalism revenue stream is the strongest one. All these companies double-dip.
Many even triple dip: Subscription, surveillance AND ads.
Misconceptions about section 230 (Score:2)
editing content opens slashdot up to legal action because slashdot is now responsible for the content posted.
That was the case before section 230 was enacted. But contrary to common misinterpretation, section 230 was built to preserve safe harbor status even if a provider does moderate, as a way of encouraging providers to moderate. (Source: "Why the internet’s most important law exists and how people are still getting it wrong" by Adi Robertson [theverge.com])
Re: Misconceptions about section 230 (Score:2)
CDA 230 was explicitly intended by Congress to protect children from lewd content. Corporate Nazi apologists have continually misrepresented its purpose to provide cover for political censorship which Congress clearly never envisioned.
Re: (Score:3)
I seem to be on the secret no-mod list. Haven't had mod points for the past 6 months or so?
Why is Slashdot linking to paid sites? (Score:3, Insightful)
We can only read 10 articles per month from https://www.nytimes.com/ [nytimes.com]
Re: (Score:2)
As I understand it: Slashdot links to paywalled sites for the benefit of the fraction of Slashdot users who subscribe to those sites. In some cases, this includes The Wall Street Journal, which offers zero (0) free articles per month. The rest of users are not expected to read the featured article before commenting but are expected to read the summary in its entirety.
Explain something. (Score:1)
Could you explain what "reading the article" and "reading the summary" means to those of us here on Slashdot?
-Thanks!
Long time Slashdot user; posting as AC.
Re: (Score:2)
Whoa whoa whoa, take that $#!% somewhere else. You can't just go accusing people of reading TFA. Even suggesting someone read TFS is bad enough.
Okay, off to /b/ with you. Let the punishment fit the crime.
Re: (Score:2)
Re: Why is Slashdot linking to paid sites? (Score:2)
Re: (Score:2)
how's the weather in Tel Aviv?
Ask me next week.
Re: (Score:3)
People use Discord, Slack, and Skype for a few reasons:
- Self-hosted IRC doesn't work well for collaboration across time zones or across multiple devices because IRC by default keeps no log through which a user can catch up on important conversations that occurred while the user was at another job or asleep.
- Self-hosted IRC doesn't support attachments. The server operator needs to set up a separate web-based file drop for use by users of the server.
- Self-hosted services in general don't work when an ISP
Try Mattermost instead (Score:5, Informative)
Slack competitor Mattermost can be self-hosted [mattermost.com]. But a lot of teams started using Slack between August 2013 and October 2015, when there was no such thing as Mattermost.
Re: (Score:2)
People use middlemen because they perceive that the alternative to middlemen is IRC with all its drawbacks.
Re: (Score:2)
Self-hosted IRC doesn't work well for collaboration across time zones or across multiple devices because IRC by default keeps no log through which a user can catch up on important conversations that occurred while the user was at another job or asleep.
Write a "bot" to do that for you. I did and it is still running on #c in EFNET 20 years later.
Self-hosted IRC doesn't support attachments. The server operator needs to set up a separate web-based file drop for use by users of the server.
Never heard of dcc send?
Self-hosted services in general don't work when an ISP blocks all incoming TCP connections (as Bert64 mentioned).
Indeed. That war has been going for decades and we are still losing. You could rent a Linux instance or pay to have your computer/server placed in a hosting environment.
You should learn more about IRC and it might be helpful to look more for solutions than for reasons why something can't happen.
Re: (Score:2)
Write a "bot" to do that for you.
Which IRC server software distributions come packaged with such a logging bot? Or is it up to the server operator or an operator in each channel to maintain a logging bot?
Never heard of dcc send?
DCC SEND does not work when both sides are behind NAT. It is a victim of the "war" that you pointed out "has been going for decades and we are still losing." In addition, DCC SEND is from one user to another single user, not from one user to all other interested users in a channel.
You could rent a Linux instance or pay to have your computer/server placed in a hosting environment.
The argument then becomes "For the price of hiring an emplo
Chat history is useful to orgs (Score:5, Interesting)
When I join a new company that uses Slack, I have access to chat history for all the channels I'm on, and can find solutions to concrete problems and see discussions that led to a decision. It's very useful. That's why Slack uses limitations on search on the free version as a way to get people to upgrade - history is a feature. Short retention periods may be useful for some limited kinds of discussion, but it would be an awful default for most.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
That's what wiki sites are for, because the information is now n
Re: (Score:2)
There's a place for wikis too, but they usually capture more tested information and howtos, and they usually cover less. Slack (or Flowdock, or other competitors) are a much larger, non-curated resource that you go to if the wiki doesn't cover it. Important to have both.
EFF is Dangerously Wrong on this one (Score:2)
EFF does lots of good work, but Gennie Gebhart is dangerously wrong on this one.
The entire premise of "services should be free" is what has enabled the Surveillance Society on the Internet. Trying to shame Slack into giving a token more privacy merely extends the problem, and in doing so makes it worse. They're still not e2e and of course they have incentive to mine the chat data for sale to the highest bidder. The cynic may say that they are taking this IPO opportunity to try to get some free press, but
Re: (Score:2)
The early internet was a communist utopia. Everything was free. To each according to his needs, from each according to his abilities. We need to hold our ground and kick the for-profit parasites off the internet. Make it actually good again.
This post has no author and smells of troll, but I'll respond in case there are some who might believe what it says.
The early Internet cost 1,000 to 1,000,000 times more than it costs today (not an exact estimate; for illustration purposes only). The free-ranging information sharing that might be fondly remembered was possible because it came at a point when lots of money was available to make networking/Internetworking *work*, nothing was expected to be showing a profit/return on investment yet, and the
the ultimate false dichotomy (Score:2)
It's terrible karma to ignore fixing $IMMEDIATE_PROBLEM in the hope—often naive—that by doing so you can turn collective attention toward addressing a deeper root problem.
Often the deepest root meta problem is that people don't want to solve the deepest root problem. Or they
stupid question (Score:2)
because it's work, not sexting with your boyfriend
Why? (Score:2)
Re: I blame the yellow menace (Score:2)
What "many people"?
For legal discovery (Score:2)
Re: (Score:2)
If you want to replace email you need to do it with something that meets current legal discovery guidelines, or you'll be toast in court.
Legal discovery is a process through which an adversary gets to troll through one's records looking for clues that will bolster their suit against one. It is generally in one's best interests to have as few records available for discovery as possible, if only to avoid the expense of having to make those records available. The dynamic tension for a business lies in the need of that business to maintain some historical records for their own benefit, and to meet specific legal record-keeping requirements bas
Thatt feature is for micromanagers (Score:2)
That feature is for micromanaging peanut-brain managers.
I worked for a guy who would trawl the logs looking for any little detail to ding you on. We had to report arrival, breaks, (yes potty breaks too), lunch, and departure. All communications were done on Slack first with email for cya backup.
Didn't stay there long.
But yes, that's what it's for. It's for incompetent impotent managers.
The Internet is not Anonymous or Private (Score:3)
Time for Slack to cut the slack (Score:1)
nt
Password? (Score:2)
>Right now, Slack stores everything you do on its platform by default -- your username and password, every message you've sent //
Ok, everything else is a given, but do they really store passwords? Nothing in the link documents suggested that they actually did? What's Slacks password set up?
Why have you not switched to Mattermost? (Score:1)
If you have any sense, you switch to Mattermost and set it up on your own server. All data and user details secured.
Keybase? (Score:1)
Are there others?
Make your own secure version (Score:1)
Social cooling (Score:5, Informative)
Businesses use data collected through widespread surveillance of Internet users to decide whom to hire, to whom to show ads for high-paying jobs, what loan interest rate or health insurance rate to offer, which dating partners to suggest, from whom to accept goods returned as defective, and whom to audit for tax evasion. The fear of unfavorable automated decisions has led some Internet users to self-censor to avoid risk, a phenomenon called "social cooling." [socialcooling.com]
Are people unaware of this surveillance? Aware of the surveillance but unaware of how the data is used? Or aware of how the data is used but under the impression that an unfavorable automated decision will never happen to them? The answer informs whether or not a user is likely to take after falling victim to such an unfavorable decision.