Proactive Measures Against Password Breaches and Cookie Hijacking

This post details the extension of Slack's proactive security measures to include user passwords and session cookies. It describes the process of ingesting threat intelligence data, salting and hashing candidate passwords for comparison with securely stored salted hashes, and using a job queue for parallel processing. For hijacked cookies, it explains the monitoring of threat intelligence datastreams, the invalidation of exfiltrated cookies, and a nuanced approach to scheduling invalidation outside of user working hours based on geography and timezone. It also mentions adding events to Slack Audit Logs for Enterprise plans.