Stored in plain text on the device: Slack wants some users to reset their password
of David Wurm 
on February 06, 2021, 18:03 am | 🔥 popular | Write a comment
There was a glitch with Slack - for a month some users had logged the passwords in clear text on their own device. Some Android users are affected and are now being asked to change their password. So it is not a phishing email.
Got an email from Slack too? Time and again, so-called “phishing emails” are on the way to pick up passwords. This time around, you'd think it would be with Slack. But it is not: As of today, Slack is asking some Android users to reset their passwords by email.
Reset Slack Password: Users & Workspace Admins receive email
Under the subject "[Security update]: Your Slack accountThe company is currently sending emails to users personally with the following slogans: "[Security Update]: Your Slack Account". Unfortunately, they have not done a very good job of addressing the user personally by name, which is usually the first indicator of a phishing email. Not only the users themselves, but also the workspace administrators have received an email. Depending on the language set in Slack, it is written in either German, English or another language. The administrator can see which users are affected by this problem.
Workspace administrators receive this email about this incident. (Image: TechnikNews/Screenshot)
We recommend resetting your password immediately after receiving this email using the link provided. The workspace administrator may force you to do this anyway and you will no longer be able to log in with the current password. Companies that use SSO login are not affected by this. Even if the password was only made "public" on your own device, other apps and the system would have been able to access these logs. It should then no longer be a problem to read the password. Alternatively, a user can always reset their password using the following link: [workspace].slack.com/account/settings#password
This is the email that Slack users receive
The full email to users is as follows:
Hi
Slack would like to reset the password for the [your username] account on [workspace].slack.com. This is a precautionary measure due to a bug we discovered. There is no indication that anyone unauthorized or third-party has accessed this account. We take the security of your team and the privacy of your communications data very seriously. We apologize for any inconvenience this may cause.
On December 21, 2020, Slack encountered a bug that caused some versions of our Android app to store user credentials in plain text on their devices protokolled. Slack identified the issue on January 20, 2021 and fixed it on January 21, 2021. A clean version of the Android app is available, and we have stopped use of the affected version(s).
If you'd like to set a new password immediately, click the link below:
We strongly recommend creating a difficult and unique password. This is the only way to protect the integrity of your account. It's best to use a password manager. So you always know which password you have chosen for each of your services.
Finally, you can manually delete the logs from your device. Please note that this action will also log you out of all Slack workspaces you are a member of. We have proTokenized password already invalidated. However, if you also use it to log in to other websites, we strongly recommend performing this action.
On your Android device, you can do this with the help of the following instructions:
- Open the app on your home page Settings
- Scroll down and select Apps from
- Find and choose Slack from
- Choose memory from
- Click on the left delete data
- Click on OKto confirm that you want to delete the data
- Sign in to Slack with your new password
We are very sorry for the inconvenience caused. If you have any further questions, just reply to this notification. Our support team is always there for you.
With kind regards,
Your Slack team
We cannot say ourselves whether users who have not received a notification are really not affected by it. It's best to use one anyway Password manager and still resets his Slack password to be on the safe side. As a further measure, you should always use two-factor authentication. Then the password alone is of no use to a possible hacker. This is how you play it safe.