Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Security on the Web: Slack's Token Security Leak, "Do Not Track"

DZone's Guide to

Security on the Web: Slack's Token Security Leak, "Do Not Track"

"ChatOps" is the name for a style of team collaboration and development. ChatBots are one of Slack's most popular features, allowing the team to perform complex tasks from chat, but is it secure to do so? No. And "Do Not Track" gets a nudge in the right direction.

· DevOps Zone
Free Resource

The Nexus Suite is uniquely architected for a DevOps native world and creates value early in the development pipeline, provides precise contextual controls at every phase, and accelerates DevOps innovation with automation you can trust. Read how in this ebook.

Slack's Security Email Slack-luster Security

Slack is only three years old, and despite clear popularity, is still experiencing some growing pains: the celebrated chatbot integrations that enable teamwork are also, the wrong hands, prolific leakers of credentials. 

Security firm Detectify, who researched the common flaw in coding practice, wrote "There’s no easy way to see if someone is eavesdropping on the communication." 

This follows the news in October of 2014 that also documented problems with the "team discovery" feature that made channels visible to unauthorized users.

Not Just a Slack Problem

While Slack's bots are easy to write, be wary of passing credentials through them. 

A bot's code that contains Slack tokens gives any reader a way of accessing internal chats and files on Slack. Researchers went on to write they have  found "thousands of tokens by simply searching GitHub."

“Slack is clear and specific that tokens should be treated just like passwords. We warn developers when they generate a token never to share it with other users or applications. Our customers’ security is of paramount importance to us, and we will continue to improve our documentation and communications to ensure that this message is urgently expressed.” (Slack)

Slack tokens carry a distinct morphology that helps identify them, and GitHub's features are helpful enough to let you try this out for yourself. Slack's tokens are not alone in that regard: credentials of all types carry identifying patterns that are visible with a full text search.

GitHub has been targetted and harvested for credentials before, as when hackers scraped an account for Amazon Web Services credentials and mined LiteCoin.

Do Not Track

In other security news, the w3c Tracking Protection Group has invited server-side implementation of the "Do Not Track" preference.

While users have been able to send the preference for some time, there is no implementation which can claim compliance according to the (working draft) of the standard.

Image title

The DevOps Zone is brought to you in partnership with Sonatype Nexus.  See how the Nexus platform infuses precise open source component intelligence into the DevOps pipeline early, everywhere, and at scale. Read how in this ebook

Topics:
security ,devops ,webdev

Opinions expressed by DZone contributors are their own.

THE DZONE NEWSLETTER

Dev Resources & Solutions Straight to Your Inbox

Thanks for subscribing!

Awesome! Check your inbox to verify your email so you can start receiving the latest in tech news and resources.

X

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}