Can you imagine Slack letting people DM strangers in another org? Think of the abuse. Oh wait, it did do that
(2021/03/24)
- Reference: 1616615930
- News link: https://www.theregister.co.uk/2021/03/24/slack_email_invites/
- Source link:
Updated Slack, which became popular as a team chat app in part because it's not email, is now letting users invite anyone, via email, to correspond using direct messages in the Slack app.
The collaboration biz, in the process of being acquired by Salesforce, [1]announced the service, called Slack Connect Direct Messages, last October and made it available on Wednesday. It's part of [2]Slack Connect , which provides a way to bring as many as 20 separate organizations into a single Slack channel.
[3]
Slack says the capability is available to individuals on Free, Standard, Plus, and Enterprise Grid plans, though the ability to manage Slack Connect settings and permissions not available to those on the Free plan.
Slack has entered the Matrix: Element builds a bridge to realm of encrypted, decentralised comms [4]READ MORE
[5]
"Slack Connect allows you to send direct messages (DMs) to people outside your company, providing an easy way to work with your partners," the company explains in [6]a help center document . "Once an invitation has been sent and accepted, you can begin exchanging messages with someone from another organization, just like you would in other DMs."
In Slack's desktop client, the process involves clicking the compose button in the top left-hand corner of one's workspace and entering the recipient's email address in the To: field. The recipient will receive a unique link in an email that can be used by one person, and a customized message if one was included by the sender.
Or at least that was the way it worked when it debuted. Word of the change has prompted some alarm among those who adopted Slack primarily because of its high signal-to-noise ratio.
Hello, users here!
"It could potentially suck," observed John Paul Minda, professor of psychology at Western University, [7]via Twitter . "The only reason I pay for and use [8]@SlackHQ is [because] it’s a closed system with my students [and] lab. The very first sign of getting an unsolicited message from anyone outside my lab (a.k.a. Spam), I’ll cancel and just switch to [Microsoft] Teams."
To which Slack, mindful of social media chatter, responded that Slack Connect DMs can be [9]deactivated by workspace owners and administrators, if your plan allows for it.
Accepting an emailed Connect DM invitation requires the receiving party to opt-in by clicking on the link and may require further approval from one or both admins responsible for the communicating parties, via the Manage shared channels menu.
Nonetheless, there's concern about [10]the potential for abuse , particularly given Slack's past [11]refusal to implement a muting or blocking capability to silence workplace harassment and its reiteration of that policy on Wednesday.
A feature to block members isn't on our roadmap currently, however we really appreciate you letting us know it's something you'd like to see in future iterations. For now, you can mute DMs with members by using the /mute command in the message input field and hitting enter. — Slack (@SlackHQ) [12]March 24, 2021
Confronted with evidence that invitations with customized text can easily be weaponized to spam people with harassment and abuse, Slack has committed to dropping that capability, even though the company appears to have been [13]aware of the issue a week ago.
In other words, you can still send invites, you just can't stick your rude messages in them, as the invite wording, from the get-go.
And that doesn't resolve other issues, like the [14]corporate policy complications that arise when people working for different organizations open a channel to one another or the fact that while Slack messages are encrypted in transit and at rest, they may still be accessible to account owners and administrators, depending on whether the account is free or paid.
To win over the unconvinced, Slack may find that further marketing is necessary... ®
Took about 4 hours for our security & IT team to disable Slack “Connect DMs.” We don’t need a shittier version of email to exist in probably the worst email client imaginable without any of the security tools to protect employees. Hard pass. — Mitchell Hashimoto (@mitchellh) [15]March 24, 2021
Updated to add
“After rolling out Slack Connect DMs this morning, we received valuable feedback from our users about how email invitations to use the feature could potentially be used to send abusive or harassing messages," Jonathan Prince, communications and policy veep at the chat app, said in a statement.
"We are taking immediate steps to prevent this kind of abuse, beginning with the removal today of the ability to customize a message when a user invites someone to Slack Connect DMs. Slack Connect’s security features and robust administrative controls are a core part of its value both for individual users and their organizations.
[16]
"We made a mistake in this initial roll-out that is inconsistent with our goals for the product and the typical experience of Slack Connect usage. As always, we are grateful to everyone who spoke up, and we are committed to fixing this issue."
Get our [17]Tech Resources
[1] https://slack.com/intl/en-se/blog/transformation/people-partners-systems-slack
[2] https://slack.com/connect
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2021/01/20/matrix_slack/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://slack.com/help/articles/1500001422062-Start-a-direct-message-with-someone-outside-your-company
[7] https://twitter.com/PaulMinda1/status/1374751063870484481?s=20
[8] https://twitter.com/SlackHQ
[9] https://slack.com/help/articles/360050528953-Manage-Slack-Connect-settings-and-permissions-#slack-connect-for-dms
[10] https://twitter.com/44/status/1374737695444901891?s=20
[11] https://twitter.com/SlackHQ/status/908701337365499904
[12] https://twitter.com/SlackHQ/status/1374711520756633600?ref_src=twsrc%5Etfw
[13] https://twitter.com/clinejj/status/1372271763824984070?s=20
[14] https://twitter.com/theroxyd/status/1374769251656085505?s=20
[15] https://twitter.com/mitchellh/status/1374792991034941444?ref_src=twsrc%5Etfw
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
The collaboration biz, in the process of being acquired by Salesforce, [1]announced the service, called Slack Connect Direct Messages, last October and made it available on Wednesday. It's part of [2]Slack Connect , which provides a way to bring as many as 20 separate organizations into a single Slack channel.
[3]
Slack says the capability is available to individuals on Free, Standard, Plus, and Enterprise Grid plans, though the ability to manage Slack Connect settings and permissions not available to those on the Free plan.
Slack has entered the Matrix: Element builds a bridge to realm of encrypted, decentralised comms [4]READ MORE
[5]
"Slack Connect allows you to send direct messages (DMs) to people outside your company, providing an easy way to work with your partners," the company explains in [6]a help center document . "Once an invitation has been sent and accepted, you can begin exchanging messages with someone from another organization, just like you would in other DMs."
In Slack's desktop client, the process involves clicking the compose button in the top left-hand corner of one's workspace and entering the recipient's email address in the To: field. The recipient will receive a unique link in an email that can be used by one person, and a customized message if one was included by the sender.
Or at least that was the way it worked when it debuted. Word of the change has prompted some alarm among those who adopted Slack primarily because of its high signal-to-noise ratio.
Hello, users here!
"It could potentially suck," observed John Paul Minda, professor of psychology at Western University, [7]via Twitter . "The only reason I pay for and use [8]@SlackHQ is [because] it’s a closed system with my students [and] lab. The very first sign of getting an unsolicited message from anyone outside my lab (a.k.a. Spam), I’ll cancel and just switch to [Microsoft] Teams."
To which Slack, mindful of social media chatter, responded that Slack Connect DMs can be [9]deactivated by workspace owners and administrators, if your plan allows for it.
Accepting an emailed Connect DM invitation requires the receiving party to opt-in by clicking on the link and may require further approval from one or both admins responsible for the communicating parties, via the Manage shared channels menu.
Nonetheless, there's concern about [10]the potential for abuse , particularly given Slack's past [11]refusal to implement a muting or blocking capability to silence workplace harassment and its reiteration of that policy on Wednesday.
A feature to block members isn't on our roadmap currently, however we really appreciate you letting us know it's something you'd like to see in future iterations. For now, you can mute DMs with members by using the /mute command in the message input field and hitting enter. — Slack (@SlackHQ) [12]March 24, 2021
Confronted with evidence that invitations with customized text can easily be weaponized to spam people with harassment and abuse, Slack has committed to dropping that capability, even though the company appears to have been [13]aware of the issue a week ago.
In other words, you can still send invites, you just can't stick your rude messages in them, as the invite wording, from the get-go.
And that doesn't resolve other issues, like the [14]corporate policy complications that arise when people working for different organizations open a channel to one another or the fact that while Slack messages are encrypted in transit and at rest, they may still be accessible to account owners and administrators, depending on whether the account is free or paid.
To win over the unconvinced, Slack may find that further marketing is necessary... ®
Took about 4 hours for our security & IT team to disable Slack “Connect DMs.” We don’t need a shittier version of email to exist in probably the worst email client imaginable without any of the security tools to protect employees. Hard pass. — Mitchell Hashimoto (@mitchellh) [15]March 24, 2021
Updated to add
“After rolling out Slack Connect DMs this morning, we received valuable feedback from our users about how email invitations to use the feature could potentially be used to send abusive or harassing messages," Jonathan Prince, communications and policy veep at the chat app, said in a statement.
"We are taking immediate steps to prevent this kind of abuse, beginning with the removal today of the ability to customize a message when a user invites someone to Slack Connect DMs. Slack Connect’s security features and robust administrative controls are a core part of its value both for individual users and their organizations.
[16]
"We made a mistake in this initial roll-out that is inconsistent with our goals for the product and the typical experience of Slack Connect usage. As always, we are grateful to everyone who spoke up, and we are committed to fixing this issue."
Get our [17]Tech Resources
[1] https://slack.com/intl/en-se/blog/transformation/people-partners-systems-slack
[2] https://slack.com/connect
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2021/01/20/matrix_slack/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://slack.com/help/articles/1500001422062-Start-a-direct-message-with-someone-outside-your-company
[7] https://twitter.com/PaulMinda1/status/1374751063870484481?s=20
[8] https://twitter.com/SlackHQ
[9] https://slack.com/help/articles/360050528953-Manage-Slack-Connect-settings-and-permissions-#slack-connect-for-dms
[10] https://twitter.com/44/status/1374737695444901891?s=20
[11] https://twitter.com/SlackHQ/status/908701337365499904
[12] https://twitter.com/SlackHQ/status/1374711520756633600?ref_src=twsrc%5Etfw
[13] https://twitter.com/clinejj/status/1372271763824984070?s=20
[14] https://twitter.com/theroxyd/status/1374769251656085505?s=20
[15] https://twitter.com/mitchellh/status/1374792991034941444?ref_src=twsrc%5Etfw
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offprem/saas&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YFvEjEVOl7o4wtOT6yQWKwAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
Never trusted slack, Never will.
sreynolds
I don't trust MS's 365 nor googles central we store your email offerings, even where the protocol for communication is quite small and quite clear. Why would anyone use Slack that could possibly leak so much about your org is beyond my comprehension. I mean apart from IBM with an average employee age of 16, who would use it?
Re: Never trusted slack, Never will.
Anonymous Coward
+1
I mean apart from IBM with an average employee age of 16, who would use it?
I was on a contract there when there when the project I was on switched over to Slack - the group of graduates on the project were tasked with evangelising Slack and the multiple channels that they setup for the project - I was glad to be shot of the whole lot on my last day
Bye bye Slack
Pascal Monett
You have just done a Microsoft on your foot. A simple message can get anyone into anywhere ? And it takes 4 hours to shut that down ?
Thanks for the heads-up. Slack is now on my blacklist.
Sorry about that
HildyJ
But we'll make it better.
How many times have we heard that from companies, especially those promoting the 'next big thing'? How many times have they failed to deliver?
I don't believe it anymore. Questionable 'features' were designed and implemented that way.
differnt?
Than all the people or bots that tried to chat me up on Skype? By default allow only my contacts was off... Shame on me?