I love Slack. It's an awesome product. My co-founder Ryan Shea and I switched over to Slack from Flowdock last summer and love using the product everyday. I just noticed this tweet:

This is one of my nightmares coming true.

A little context: our project Blockstack provides decentralized apps using the blockchain. We enable people to control their username and profile with a private key and we're powered by the same technology as Bitcoin. Given how much we deal with private keys and Bitcoin, security is extremely important to us.

Back in March 2014, Ryan and I talked about how we feel uncomfortable chatting on Flowdock given that the communication channel is not encrypted and there are definitely chat logs being saved somewhere on a server. A server that we don't have access to. A server whose security we cannot audit. A server that can be hacked to access our chat logs. Heck, we even tried setting up our own IRC chat deployment on our server.

Ugly ah? Yes, the UX of IRC was bad enough that we eventually came back to products like Flowdock and Slack. However, every now and then we'll have this feeling of uneasiness that our chat logs are on a centralized company. Something bad will happen eventually. We should move to our own deployment. Tick tock.

The interesting thing about security is no one cares about it until shit hits the fan. That shiny new product feature you're working on seems so much more important than securing your chat logs. Our solution was to simply stop talking about anything sensitive over Slack. You can afford to do that when you're a small startup and literally sit next to each other. But you can't scale this as you grow.

To me the Slack hack is yet another reminder that centralized models are broken by design. Slack is an awesome company and I'm sure they'll comply with the best security practices. It doesn't look like the hacker got access to chat logs in this hack. But that still means that Slack is a single point of failure. They're a prime target for hackers. A single place from where confidential information of a lot of other companies can be accessed.

This model of centralized services and data repositories is broken by design. We need to move to a decentralized world, where users are in control of their own data, their own chat logs, with their own private keys. If Slack is managing access control (figure above) then a hack on Slack means data of all companies can get compromised. Compare this to a model where the hacker needs to compromise companies individually. I can live in that world.

Comments? Tweet them @muneeb