Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

181–190 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#181

Post by sebzim4500 »

meghan_rain wrote: post #160
visarga wrote: post #25

Earlier quoted context omitted.

You can use chatGPT inside Azure, like any other service. It's not the same one used by OpenAI, and there are different guarantees. > ChatGPT is now available in Azure OpenAI Service https://azure.microsoft.com/en-us/blog/chatgpt-is-now-availa...

Sorry but the whole point is to not use a closed source third party API with a dubious privacy police ran buy a multinational surveillance capitalism megacorporation.

Their probably already using AWS/GCP/Azure, so trusting Azure is not going to be considered nearly as big a deal as trusting OpenAI.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#183

Post by EGreg »

wantsanagent wrote: post #78

We saw these same fears with the release of Gmail. Why would you trust your email to Google?!! Aren't they going to train their spam filters on all your data? Aren't they going to sell it, or use it to sell you ads? Corporations constantly put their most sensitive data in 3rd party tools. The executive in the article was probably copying his company strategy from Google docs. Yes, there are good reasons for concern,…

I recommend you take all your proprietary code and copypaste it to ChatGPT. You can help improve our collective generator.

If you’re an artist, just send all your work to DALL-E. Why have money or fame?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#184

Post by SrslyJosh »

cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

> Wouldn’t even put it past military personnel putting S/TS information into it at this point.

Hey, they need someone to proofread their War Thunder forum posts to make sure they're using correct spelling and grammar when leaking classified info. ;-)

(Ref if you don't get the joke: https://taskandpurpose.com/news/war-thunder-forum-military-t...)

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#185

Post by nl »

michaelteter wrote: post #98
dragonwriter wrote: post #80

Earlier quoted context omitted.

> Possibly I don’t know how this all works, but I think if the host of a ChatGPT interface were willing to provide their own API key (and pay), they could then provide a “service” to others (and collect all input). Well, GP was referring to blocking ChatGPT as a federal contractor . I suspect that as a federal contractor, they are also vetting other people that they share data with, not just blocking ChatGPT as a one…

But it really seems like a cat and mouse game. For example, a very determined bad actor could infiltrate some lesser approved government contractor and provide an additional interface/API which would invite such information leaking, and possibly nobody would notice for a long time.

If someone is determined to break the rules then yes they break the rules. Network blocking is really just a thing to stop casual mistakes.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#186

Post by endisneigh »

hgsgm wrote: post #112
jackson1442 wrote: post #85

Earlier quoted context omitted.

I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in…

Google had all the same problems, until it found a balance of functionality, security, and privacy. OpenAI just hasn't started to try adding privacy and security yet.

A language model inherently has a privacy problem. How would you guarantee no leaks?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#187

Post by BonoboIO »

bob1029 wrote: post #11

We published an internal policy for AI tools last week. The basic theme is: "We see the value too, but please don't copypasta our intellectual property until we get a chance to stand up something internal." We've granted some exceptions to the team responsible for determining how to stand up something internal. Lots of shooting in the dark going on here, so I figured we would need some divulgence of our IP against pu…

Not using Chatgpt is easy, but things like GitHub or VSCode with Copilot (which is a special version of GPT3) and in the future Copilot X (gpt4) this will get hard.

One developer opening a folder in VSCode with Copilot enabled aaaaand it’s gone. You never know what part of the folder left your building.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#188

Post by javajosh »

Yep. I've been playing with it only in a Stack Overflow way for this reason. I would certainly not mention my personal proclivities or ask it to generate a new password for me. That might be appropriate for a locally hosted model, depending on how secure you can keep it.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#189

Post by judge2020 »

fnordpiglet wrote: post #144
kccqzy wrote: post #140

Earlier quoted context omitted.

Well it was, until Google Workspace (G Suite) came along and provided essentially an enterprise version of Gmail.

I still question the wisdom of giving data to the worlds largest spyware company that makes its money by converting mass surveillance into dollars.

Hosting your own servers for email and business files is infinitely more costly from a performance, uptime, and personnel standpoint, and self-hosted office with network shares is not suitable for most businesses' needs of multi-user collaboration (sure, you can use Office / M365 desktop apps which do collaboration, but then you're forced to use the desktop apps).

Google Workspace solves the issues of data privacy both by having extreme user data & datacenter access controls[0,1], a robust terms document that details how data is collected and used[2], and enterprise customers can access an audit report that details what and when things are accessed by Google employees[3].

0: https://storage.googleapis.com/gfw-touched-accounts-pdfs/goo...

1: https://workspace.google.com/security/

2: https://workspace.google.com/terms/premier_terms.html

3: https://support.google.com/a/answer/9230474?hl=en

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#190

Post by mewpmewp2 »

BonoboIO wrote: post #187
bob1029 wrote: post #11

We published an internal policy for AI tools last week. The basic theme is: "We see the value too, but please don't copypasta our intellectual property until we get a chance to stand up something internal." We've granted some exceptions to the team responsible for determining how to stand up something internal. Lots of shooting in the dark going on here, so I figured we would need some divulgence of our IP against pu…

Not using Chatgpt is easy, but things like GitHub or VSCode with Copilot (which is a special version of GPT3) and in the future Copilot X (gpt4) this will get hard. One developer opening a folder in VSCode with Copilot enabled aaaaand it’s gone. You never know what part of the folder left your building.

What if you host your code in GitHub? That concern is weird to me, because you already give Microsoft pretty much everything.

You use Windows, VSCode, etc, all of this has access to your code.

Post reply on HN