<story><title>Slack Security Incident</title><url>https://keybase.io/blog/slack-incident</url></story><parent_chain><item><author>numair</author><text>The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message.&lt;p&gt;Let me see if I have this right:&lt;p&gt;Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affected users. And in the interim they blamed their users for any related security problems.&lt;p&gt;Do I have this correct? If so, how is anyone going to defend this situation? And how can anyone put any sensitive data on Slack, or tell their company to do so, and feel good about it now?&lt;p&gt;I expected some stupid apology note from the CEO on their website if this turns into a bigger issue, which is sort of an anti-pattern at this point...</text></item></parent_chain><comment><author>johncolanduoni</author><text>The issue looks to be that they thought they had informed all the affected users back in 2015, but underestimated the set of affected users. The breach certainly wasn’t secret until today, they posted it publicly at that time: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;slackhq.com&amp;#x2F;march-2015-security-incident-and-the-launch-of-two-factor-authentication&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;slackhq.com&amp;#x2F;march-2015-security-incident-and-the-lau...&lt;/a&gt;.</text></comment>
<story><title>Slack Security Incident</title><url>https://keybase.io/blog/slack-incident</url></story><parent_chain><item><author>numair</author><text>The author would have done well by refraining from using this as an opportunity to make a sales pitch for their startup, as it detracts from an otherwise important message.&lt;p&gt;Let me see if I have this right:&lt;p&gt;Slack had a major security breach in 2015. Apparently someone installed malicious code that could even read password inputs in plaintext. They waited 4 years, after growing large and going public, to inform affected users. And in the interim they blamed their users for any related security problems.&lt;p&gt;Do I have this correct? If so, how is anyone going to defend this situation? And how can anyone put any sensitive data on Slack, or tell their company to do so, and feel good about it now?&lt;p&gt;I expected some stupid apology note from the CEO on their website if this turns into a bigger issue, which is sort of an anti-pattern at this point...</text></item></parent_chain><comment><author>mfer</author><text>I think the point was a sales pitch. The post worked well enough to get to the top of the Hacker News front page. I think the effort was rewarded.</text></comment>