Slack Security Incident
Let's ignore the rather awkward self promotion, and the fact that 2FA would have prevented this specific incident.<p>This is the important part, which everyone should think about:<p>> What would have been way worse — immeasurably worse — is if our team had used Slack for anything other than what we did use it for, which was discussing outages of our own product. Had my cofounder and I discussed our company's cap table, or business partnerships, or compensation agreements, or ongoing legal matters over Slack; or had our team traded API keys, or security-sensitive matters; or had we controlled mission-critical infrastructure via Slack-powered "bots"; we'd be sweating bullets to this day that our important company secrets were out in the open, about to resurface at the worst possible time.<p>I see Slack being used for everything at a lot of companies.<p>There are a lot of interesting things in the chat history everywhere: SSH/API keys, logins and passwords, sensitive internal documents, chatops bots that would let one take control of the infrastructure, and worst of all - juicy office affair gossip.<p>Combine this with often lax user management (forgetting to disable old accounts, inviting people to channels they shouldn't be in, ...).<p>Most companies overlook this and don't even have a policy for what's OK to post on Slack, and what isn't. Not even to dream of any kind of enforcement.<p>I'ts a big security problem, even without Slack getting compromised, and should be on the radar for CTOs.