500
ChatGPT is leaking passwords from private conversations of its users, Ars reader says
(arstechnica.com)
this post was submitted on 30 Jan 2024
500 points (93.1% liked)
Technology
59298 readers
4992 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It also literally says to not input sensitive data...
This is one of the first things I flagged regarding LLMs, and later on they added the warning. But if people don't care and are still gonna feed the machine everything regardless, then that's a human problem.
Hello can you help me, my password is such and such and I can't seem to login.
People literally do this though. I work in IT and people have literally said, out loud, with people around that can hear what we're saying clearly, this exact thing.
I'm like.... I don't want your password. I never want your password. I barely know what my password is. I use a password manager.
IT should never need your password. Your boss and work shouldn't need it. I can log in as you without it most of the time. I don't, because I couldn't give any less of a fuck what the hell you're doing, but I can if I need to....
If your IT person knows what they're doing, most of the time for routine stuff, you shouldn't really see them working, things just get fixed.
Gah.
Lmao my IT guy asks for our passwords to certain things on an annual basis, stores them as plain text in a fucking email.
First Time he did it I was like "uhh, not supposed to share that?" And he just insisted he needed it. Whatever, he wants to log in to my Autodesk account he's free to. Not sure how much damage he could do.
That's the problem, right there.
Companies either don't allow for IT oversight of accounts or charge more for accounts that can be overseen. Companies don't want to pay the extra, if that's even an option on the platform, so some passwords end up being fairly common knowledge among the IT staff.
As for your computer login? No thanks. Microsoft has been built pretty much from the ground up to be administratable. I can get into your files, check what you're running, extract data, modify your settings, adjust just about anything I want if I know what I'm doing. All without you realizing that I've done anything.
Companies like Autodesk really don't have that kind of oversight available for accounts that they're willing to provide to an administrator that's managing your access. I should be able to list the license that you've been given, download whatever software that license is associated to, and purchase/apply new licensing, all from a central control panel for the company under my own administrative user account for their site, whether I'm assigned any software/licensing or not. They don't. It makes my job very complicated when that's the case.
In the event you brick your computer (or lose it, or destroy it, or something.... Whether intentional or not), I sometimes need your password to go download your software and install it, then apply your license to it, so that it's ready to go when you get your system back. You might lose any customizations, but you'll at least have the tools to do the job.
On the flip side, an example of good access is with Microsoft 365. You're having a problem finding an email, I can trace the message in the control panel, get it's unique ID, set your mailbox to provide myself full access to see it, then switch mailboxes to yours, while I'm still signed in as myself, find the message you accidentally moved into the draft messages folder and move it back to your inbox. Then remove my access and the message just appears in your inbox without you doing anything. I didn't need to talk to you, I didn't need your password... Nothing. No interaction, just fixed.
There's hundreds of examples of both good and bad administrative access, and it varies dramatically depending on the software vendor. In a perfect world I would have tools like what I get from exchange online for all the software and tools you use. Fact is, most companies are just too lazy to do it, instead of paying the developers to do things well, they'd rather give the money to their shareholders and let us IT folks suffer. They don't give a shit about us.