Slack developers have notified about 0.5% of users that they are forcibly resetting their passwords due to a bug. They will need to change their passwords due to a recently fixed bug that exposed salted password hashes when creating or revoking invite links.
Let me remind you that we also wrote that ToTok messenger turned out to be a tool for total tracking, and also that UseCrypt Messenger developers filed a lawsuit against IS researcher for finding bugs.
The official announcement states that the mentioned bug was discovered and fixed in the Slack Shared Invite Link feature, which allows Slack Workspace owners to create special links. With such a link, anyone can join the conversation, and this feature was created as an alternative to inviting people one at a time.
Links created or revoked by users between April 17, 2017 and July 17, 2022 were found to expose their hashed passwords via web socket to all Slack-connected workspace members.
Slack also reminded that all users are encouraged to use multi-factor authentication, as well as install updates in a timely manner and use up-to-date anti-malware tools.
What to do if Slack resets your password?
The developers claim that all active accounts requiring a password reset receive direct notifications with instructions. For information about resetting your password, you can visit the Slack Help Center at any time.
