Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by jdkanani | Hacker News Reader

Parent Full thread

jdkanani·

I just realized that any facebook user can signup on https://facebook.slack.com/ with his fb username.

View on HN

And this is why you should silo customer domains from internal domains as github did (smartly)!

I am curious. Could you elaborate on this?

Edit: I wonder how Github distinguish their own "internal" email doing.

Well, this flaw is one example: Slack assumes that someone with an @facebook.com email address must be a Facebook employee. However, Facebook issues @facebook.com email addresses to regular users, too.

Github has already faced this issue and homakov[1] pointed that out.

[1] https://news.ycombinator.com/user?id=homakov

Facebook might have a directory of employees, ldap or something.

Too bad slack doesn't support any of this. This is the price they have to pay for reinventing username and password authentication and requiring everyone to register.

It is also bad since employees quit or are fired, and you don't want to have to maintain a directory of employees on every application you use.

Shameless plug, I work for https://auth0.com and we make this easier.

In their defence, Slack does have that as a "coming soon" for their enterprise version.

Don't Facebook employees use @fb.com addresses though?

Yes, they do.

Signup confirmation mail doesn't seem to arrive, maybe Facebook was quick to add a filter for mails coming from Slack.

You first have to enable your facebook email address from facebook email settings.

I'm too scared to try it - I have all my photos and stuff like that on my Facebook account. So tempting though!

If you trusted Facebook with that, you aren't scared enough.

You should backup those off facebook. However consider carefully if you wish to keep that backup in the cloud. (and which cloud).

Reply on news.ycombinator.com