Security on the Web: Slack's Token Security Leak, "Do Not Track"

Slack-luster Security

Slack is only three years old, and despite clear popularity, is still experiencing some growing pains: the celebrated chatbot integrations that enable teamwork are also, the wrong hands, prolific leakers of credentials. 

Security firm Detectify, who researched the common flaw in coding practice, wrote "There’s no easy way to see if someone is eavesdropping on the communication." 

This follows the news in October of 2014 that also documented problems with the "team discovery" feature that made channels visible to unauthorized users.

Not Just a Slack Problem

While Slack's bots are easy to write, be wary of passing credentials through them. 

A bot's code that contains Slack tokens gives any reader a way of accessing internal chats and files on Slack. Researchers went on to write they have  found "thousands of tokens by simply searching GitHub."

“Slack is clear and specific that tokens should be treated just like passwords. We warn developers when they generate a token never to share it with other users or applications. Our customers’ security is of paramount importance to us, and we will continue to improve our documentation and communications to ensure that this message is urgently expressed.” (Slack)

Slack tokens carry a distinct morphology that helps identify them, and GitHub's features are helpful enough to let you try this out for yourself. Slack's tokens are not alone in that regard: credentials of all types carry identifying patterns that are visible with a full text search.

GitHub has been targetted and harvested for credentials before, as when hackers scraped an account for Amazon Web Services credentials and mined LiteCoin.

Do Not Track

In other security news, the w3c Tracking Protection Group has invited server-side implementation of the "Do Not Track" preference.

While users have been able to send the preference for some time, there is no implementation which can claim compliance according to the (working draft) of the standard.