Hacker News Reader

Comment by paxys | Hacker News Reader

If your employees’ browser cookies are being bought and sold on the open market and tech support is handing out 2FA tokens over chat then which IM software you use is the least of your concerns.

View on HN

Of course, but on the topic of slack, shouldn't there be more security than a browser cookie required to get access?

I get that this in normal scenarios this cookie wouldn't leave the machine, I get that it's very convenient to not have to log in all the time, I get that Slack people know this stuff a lot better than me... but it sure seems like a weakness to have single point of failure to leak your slack channel by losing a cookie. Isn't it?

Giving your cookies short timeouts, say 5 minutes, and including the client's ip address in the cookie are both mitigating techniques.

So you would be signed out of Slack every 5 minutes?

No, Slack would reauthenticate every 5 minutes. It doesn't mean that the user needs to do anything.

If you closed Slack for more than 5 mins, you’d get signed out. Users would hate it, which is why nobody does this.

So, the alternative should be "don't trust anything in slack because someone can just get your cookie and log in as you"?

Maybe there is a middle ground?

The middle ground is the SSO reauth interval, where companies can decide that for greater security they’ll made you reauth every 8 hours, daily, weekly etc to balance it against user pain. Companies do this today already.

Who closes slack for more than 5 minutes though? My desktop slack is pretty much running 24/7.

No, the client would need to renew the cookie every 2.5 mins (similar approach to DHCP leases). If the external IP has changed, the cookie should not be renewed. If it's expired already, it should not be renewed.

This wont work, though, as nobody wants to sign in once per day. That's too inconvenient.

For customers, yes, but I've worked at places where we required employees to re-auth daily (if not more frequently).

I worked at a place where re-auth was required every twelve hours, which was a convenient reminder of when you'd been working way too long.

If you are using SSO (to enforce U2F) and password managers (really, basic levels of enterprise auth competence in 2021) then signing in multiple times per day isn't a huge hassle because it's just a click and a tap.

ISPs (especially mobile ones) sometimes rotate IP addresses in an little as 4 hours. Relying on static IP addresses throughout a client session might be more secure but will result in people getting logged out very frequently.

Plus, even with the most strict filtering client IP addresses can always be spoofed.

Encoding the IP as part of the session is not very common practice as many people switch their devices between different wifi networks and mobile

MAC address would work for this, no? Wouldn't solve the spoofing but solves the dynamic IP address issue.

MAC addresses are not exposed to web sites, and for good reason. It would be the mother of all supercookies.

Wouldn't a supercookie like that make things more secure though? You could even use it for fingerprinting to help combat things like spam.

MAC addresses aren't sent over the Internet.

MAC address cannot be seen past your local gateway.

Spoofing an IP address is easy. Receiving the packets sent to that address when you don't control that address - not so easy.

Slack is used for long term communication. If I’m walking around town on my phone, I absolutely don’t want slack to get logged out every time I connect to some wifi network.

Basically every website on the internet uses cookies to authenticate and verify sessions. At the end of the day, you'll always have a "single point of failure" when you need to restore remote state. Sometimes that's a password, sometimes that's a cookie.

MFA, pin code, os or tpm or browser finger printing / cookie signed to your machine, ip address or ip range lock, reauth over a short but not unreasonable time, concurrent session lock out... I would think there are few options besides just throwing your hands up and admitting failure where someone can just pay $10 for a plug and play cookie.

I don't know about a giant company like EA, but you could really screw with my company's plans if you spent any time on our Slack.

So now I need to consider that any malware could (and probably is) looking for slack cookies to exfil. So, no, I don't really believe there is always going to just be a single point of failure and it's an insurmountable problem.

Reply on news.ycombinator.com