Slashdot Mirror
Slack Hands Over Control of Encryption Keys To Regulated Customers (techcrunch.com)
Business communications and collaboration service Slack said today that it is launching Enterprise Key Management (EKM) for Slack, a new tool that enables customers to control their encryption keys in the enterprise version of the communications app. The keys are managed in the AWS KMS key management tool. From a report: Geoff Belknap, chief security officer (CSO) at Slack, says that the new tool should appeal to customers in regulated industries, who might need tighter control over security. "Markets like financial services, health care and government are typically underserved in terms of which collaboration tools they can use, so we wanted to design an experience that catered to their particular security needs," Belknap told TechCrunch. Slack currently encrypts data in transit and at rest, but the new tool augments this by giving customers greater control over the encryption keys that Slack uses to encrypt messages and files being shared inside the app.
He said that regulated industries in particular have been requesting the ability to control their own encryption keys including the ability to revoke them if it was required for security reasons. "EKM is a key requirement for growing enterprise companies of all sizes, and was a requested feature from many of our Enterprise Grid customers. We wanted to give these customers full control over their encryption keys, and when or if they want to revoke them," he said. Further reading: Slack Doesn't Have End-to-End Encryption Because Your Boss Doesn't Want It.
He said that regulated industries in particular have been requesting the ability to control their own encryption keys including the ability to revoke them if it was required for security reasons. "EKM is a key requirement for growing enterprise companies of all sizes, and was a requested feature from many of our Enterprise Grid customers. We wanted to give these customers full control over their encryption keys, and when or if they want to revoke them," he said. Further reading: Slack Doesn't Have End-to-End Encryption Because Your Boss Doesn't Want It.
and send that splurt of keys into my boy-butthoals,
Why pay these guys
It was one of the selling points for enterprise customers. The BlackBerry Enterprise Server (BES) maintained the keys and was owned by the customer.
... how is this providing better security?
With the cross VM vulnerabilities in IT hardware this seems more a PR exercise than something that actually does the job (say, managing the keys in a client's on premises hardware).
With all the illegal spying NSA Does/Did (... right) managing on any shared hosting solution seems to be not that much of an improvement - or am i missing something here?
Slack is used at work and the company SHOULD be in control of those keys.
This has nothing to do with personal privacy of anyone working or not working there, and nothing to do with the government's shortsighted effort to get all our encryption keys.
so amazon owns the keys?
In my experience, keys are generated by a computer that has never been connected to the internet and transferred by sneakernet.
How can a middleman possibly have your keys? Then they are you.?!?!
You mean you don't give your car and house keys to the friendly Walmart employees when you go shopping?
I've only seen slack at smaller type shops.
I wonder if this will scratch the security itches to get it approved at the larger firms.
Wishful thinking?
The RCMP have backdoor access to Blackberry. https://www.ctvnews.ca/canada/...
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Had slack at 2 different large companies for teams outside of Financials.
Couldn't get Slack or any cloud based equivalent for large company when working for a team in the financials area.
Did not need mobile version of Slack at one of the three jobs - manager said it was an interrupt based productivity killing machine.
Regulated by whom?
This is yet another reason never to give personal information to any corporation. Eventually they trade it or sell it off to people not so honorable.
If it's not your keys, then it's not your content. In other words, unless you created the keys yourself using your own gear and method, then you cannot guarantee that Slack cannot decrypt your communications without your knowledge. Having Slack generate your keys is ridiculous and is akin to security theater.
What you're getting with this "announcement" is security for data in transit and in storage, but there's no guarantee of confidentiality.