Slack Is Sending Out Messages Urging Users to Reset Their Passwords

  • Slack has had a misconfiguration on the Android app, causing user passwords to be logged in cleartext.
  • The problem affects a small subset of users who were notified via email on what to do.
  • Slack has kept this semi-public, creating a false phishing sense around the notifications.

Slack is sending warning messages to a small subset of its users, informing them that they urgently need to reset their passwords. As explained in the message, the reason is that the platform has mistakenly stored the passwords of this particular subset in plaintext form.

There’s no evidence that any unauthorized individuals accessed Slack’s database and, by extension, these passwords. Still, out of precaution, they will have to be reset since they are considered potentially compromised.

As the notice further explains, the error was introduced on December 21, 2020, when some versions of the Slack app for Android begun to log clear text user credentials on the device. The error was discovered a full month later, on January 20, 2021, and got fixed the next day.

Thus, if you have updated your Slack app after that date, it means that the credentials are now handled securely. However, your passwords may have been leaked in the meantime.

This is not very likely, but it’s good to see that Slack is handling this with an abundance of precaution, automatically treating these passwords as compromised instead of burying the issue. However, sending out such messages should be accompanied by a relevant notice on the blog or social media.

Source: Android Police

We understand that Slack wouldn’t want to draw more attention to this than it deserves or to cause the entire community to panic. Still, these messages are “phishy,” and when they’re not backed by a statement on any of the other official channels of the app, many recipients may disregard them as such.

Besides the password reset, users are also advised to delete the cleartext logs from their Android devices. To do this, go to Settings → Apps & notification → Slack, choose ‘Storage & cache,’ and click on the ‘Clear Storage’ and 'Clear Cache' options. That should do it.

Latest
How to Watch Grammys 2023 Online: Live Stream the Awards from Anywhere
The 2023 Grammys are around the corner, and you will find the date, time, performers, presenters, host, nominees, and everything else you...
Italy vs. France Live Stream: How to Watch Six Nations 2023 Online from Anywhere
Excitement among spectators has reached new heights as the Six Nations Rugby Championship 2023 draws near. France, the reigning champs, will get...
How to Watch ‘Murf the Surf: Jewels, Jesus, and Mayhem in the USA’ Online from Anywhere
Murf the Surf is a 2023 true-crime docuseries that pulls back the curtain on America's most infamous jewel thief, Jack Roland Murphy....
For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: Chrome, Edge, Firefox, Safari