Proactive Credential Exposure Detection and Rotation

This thread tracks the evolution of Slack's proactive security measures against credential breaches and cookie hijacking. Initial posts detail the foundational architecture for detecting and invalidating exposed tokens and webhooks. This post details the extension of these measures to include user passwords and session cookies, leveraging threat intelligence partnerships to proactively identify and reset compromised credentials before they can be misused. It also covers the nuanced approach to identifying session forking by comparing last access timestamps and IP addresses, and implementing a two-phased approach for updating session cookies to mitigate race conditions and false positives. The system now generates risk level assessments (low, medium, high) and logs high-risk events.