Finding HipChat is an insecure chat environment

I did some testing with HipChat Beta for Android here on 10/20/16. I have the Basic level service I am testing with.

I transmitted a test image in a 1 to one chat. The recipient found a option called "Copy link"  We pasted the link into a browser and pulled up the image unencrypted, no login required from the Amazon AWS S3 service.

Here is the link:

My understanding is that HipChat is offering a secure chat environment with file sharing.  What I found out from this exercise is that any sensitive files communicated are exposed to the public at large. 

I attempted to delete the test files that were uploaded, but there is no option in the HipChat Beta for Android to allow deletion of the files.

Am I missing something here?  Is HipChat supposed to be a secure collabration environment for teams or not?

Are the contents of the "secure" chat also available unprotected elsewhere on the Amazon AWS S3 service?

How are the files that I have uploaded to be deleted from the Amazon AWS S3 server?

1 answer

3 votes
Evan Michner Atlassian Team Oct 21, 2016

Hi Mark,

Thanks for writing this up. You can find some more information on how HipChat has always handled files here: 

The files you share are stored on Amazon's S3 servers and get a unique URL. The files can be viewed by anyone who has the URL. This means people who don't belong to your HipChat group can view the files if they have the files' URLs. These URLs are constructed from a random set of characters with nearly a trillion trillion possible combinations and are different for every file. 

However, we believe that many customers have different security needs, so please feel free to follow the feature request here that talks about securing those files further: While we can't provide detailed information on the timeline for that work, we can assure you (and other customers) that we believe it's a priority and we plan to solve it for you.

Again, thanks for the time to provide the feedback – we truly appreciate it and it helps us balance priorities when we hear from our customers like this.



Suggest an answer

Log in or Join to answer
Community showcase
Maarten Cautreels
Published Oct 07, 2017 in Hipchat

Bringing Structure to your HipChat Instance

...have mention name FirstnameLastname. Fe.: @MaartenCautreels This certainly helps to know who is being mentioned in a conversation. Imagine your colleague sends the following message...

466 views 1 4
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you
Atlassian Team Tour

Join us on the Team Tour

We're bringing product updates and pro tips on teamwork to ten cities around the world.

Save your spot