https://mas.to/@cubicgarden/105712244073779967
I posted about Slack’s bug on mastodon. I knew this was going to be a pain the ass changing all those passwords, even with them all sitting in my password manager and most using 2fa.
However some of the users of Mastodon asked the question, why does the Slack app store the passwords on the device at all?
I thought about this and they are right. The app connects to a remote server and should request the user login. Once logged in, it should provide some kind of secure key/cookie/hash on the device not the actual password. On top of this, it certainly shouldn’t be in the form of plaintext.
Mistake, bug or not, this should not happen.
