So last week I found a #privacy #security #exploit in Slack - I reported it on #HackerOne - but I got the reply it was working as intended.
So I wrote up about it, so you to can understand how easy it is.
https://tane.dev/2023/09/slack-wants-you-you-know-this-privacy-exploit-is-fine/
Tane Piper /
npub1q7…mdf4y
2023-09-25 21:09:29
Author Public Key
npub1q73dquw683uqdqdqd226hd0a0rkjas3usajt5u8hwv85d5edd53qkmdf4yPublished at
2023-09-25 21:09:29Event JSON
{
"id": "f8fdf08bd9f1a6399ae83110916b7e6b916406d9ed896748209996cc55a67fb9",
"pubkey": "07a2d071da3c780681a06a95abb5fd78ed2ec23c8764ba70f7730f46d32d6d22",
"created_at": 1695676169,
"kind": 1,
"tags": [
[
"t",
"Privacy"
],
[
"t",
"security"
],
[
"t",
"exploit"
],
[
"t",
"hackerone"
],
[
"proxy",
"https://tane.codes/users/tanepiper/statuses/111127833439618799",
"activitypub"
]
],
"content": "So last week I found a #privacy #security #exploit in Slack - I reported it on #HackerOne - but I got the reply it was working as intended.\n\nSo I wrote up about it, so you to can understand how easy it is.\n\nhttps://tane.dev/2023/09/slack-wants-you-you-know-this-privacy-exploit-is-fine/",
"sig": "08e7aab007562489c9fa8ea605d241fa12029d9fef85ed06fe2a0f0bebe9fbf52397470bad6767c4f7673faf4bd71c993fe52f3377de41f03f243fedd5efa737"
}