Show HN: Exploiting Slack's video embeds to achieve E2EE communication
A security researcher demonstrates a method to achieve end-to-end encrypted communication within Slack by exploiting the platform's video embed feature. The technique uses browser crypto APIs and the openpgpjs library to bypass standard server-side message visibility.
Why it matters
This highlights potential security vulnerabilities in enterprise communication platforms that allow arbitrary iframe embedding.
Some time ago, while exploring Slack’s Block Kit reference, I noticed something peculiar: the video block . When I saw that it accepted a video_url , the first thing I thought was: how does it distinguish between any content and an actual video? Would there be any particular requirement or limitation in the embed? Foreign sources?
Technical security analysis without political or social bias.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in