We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jun 15·5 min read
Show HN: Exploiting Slack's video embeds to achieve E2EE communication
TL;DR
A gap existed in secure communication within Slack, as it lacked end-to-end encryption (E2EE). A method was developed to use Slack's video embeds to send encrypted messages by leveraging browser crypto APIs.
✦ Why It Matters
Engineers can implement E2EE in existing applications by creatively using available features like video embeds.
Key Takeaways
- Explore existing platform features for security enhancements.
- Utilize cryptographic key pairs for secure messaging.
- Implement encryption without server access to keys.
- Consider creative solutions for E2EE in applications.
Full Summary
Slack's communication platform does not provide built-in end-to-end encryption (E2EE), which poses a risk for sensitive information sharing. By utilizing Slack's video block feature, which accepts any accessible video URL without strict content checks, a novel method was created to facilitate secure messaging.
Users generate a cryptographic key pair in their browser, encrypt the private key, and send it to a server. When needed, the server retrieves the encrypted key and sends it back within a video block, allowing users to perform cryptographic operations without exposing the key.
This method effectively keeps the decrypted key away from the server, enabling secure communication. The implications of this approach suggest that engineers can create secure messaging applications using existing platforms without needing extensive infrastructure changes.