Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

211–220 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#211

Post by mewpmewp2 »

itronitron wrote: post #40
crop_rotation wrote: post #17

In my experience most corporate employees just take the path of least resistance. It is not uncommon for people to paste non public data into websites just to do json formatting, and paste base64 strings to random websites just to decode them. So just telling people not to do something won't accomplish much. Most corporate employees also somehow think they know better than the policy. Any company that doesn't want to…

A while back I got to hear about how the IT team running my then-employer's internal time reporting tool was sending all the usage data through Google Analytics and how neat that was for them to look at :\ . I shudder to think what they are doing now.

I am not sure I see the issue here?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#212

Post by serf »

Teever wrote: post #196
ChatPGT wrote: post #164

Earlier quoted context omitted.

I'm doing that since day one. I can't believe people are pasting real data into this corporate black boxes.

To your average user who interfaces with these figurative black boxes with a black box in their hand, how is this particular black box any different than the other black boxes that this user hands their data to every second of every day?

there are plenty of disallowed 'black boxes' within the federal sphere; chatgpt is just yet another.

to take a stab at your question, though : my cell phone doesn't learn to get better by absorbing my telecommunications; it's just used as a means to spy on my personal life by The Powers That Be. The primary purpose of my cell phone is for the conveyance of telecommunications.

chatGPT hordes data for training and self-improvement in its' current state. It's whole modus operandi involves the capture of data, rather than it being used for that tangentially. It could not meaningfully exist without training on something, and at this stage of the game it's the trend to self-train with user data.

Until that trend changes people should probably be a bit more suspect about what kind of stuff gets thrown into the training bin.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#213

Post by mewpmewp2 »

SketchySeaBeast wrote: post #54
dannyobrien wrote: post #23

Earlier quoted context omitted.

do those other businesses use gmail? does your company?

I think those are different models. Gmail has a vested interested in keeping any knowledge it gains about you secret - it's competitive advantage is knowing more about you than anyone else does. ChatGPT's strength is its ability to clearly communicate the knowledge it has (including training data it gains from people it interacts with) to give you good responses.

I am still not seeing a huge threat to be honest. This is not how attacks are done. OpenAI also has vested interest to keep your data safe and is strongly linked to Microsoft.

Most corps, companies store a lot of internal data with corps like Google, Microsoft, Amazon and others.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#214

Post by mewpmewp2 »

agloe_dreams wrote: post #124
dubbelboer wrote: post #108

Earlier quoted context omitted.

If you're using Github already then Copilot isn't seeing anything new.

Correct, but that level of security is expected from GitHub proper, they have all sorts of independent security reviews for their partners. Does all of that exist for Copilot?

Do you think Microsoft would dare to have Copilot with any less standards?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#215

Post by spprashant »

acomjean wrote: post #163
tedunangst wrote: post #138

Earlier quoted context omitted.

Blocks are effective reminders of policies.

I remember someone trying to look up winning lottery numbers at work. The site came up "Blocked: Gambling". It was a little reminder that they're watching our web browsing at work..

Those are pre-configured firewall rules. These firewalls can go deep packet inspection and block traffic.

It's a fairly standard practice. I wouldn't associate it with overreaching surveillance.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#216

Post by ChatPGT »

gwright wrote: post #207
ChatPGT wrote: post #164

Earlier quoted context omitted.

I'm doing that since day one. I can't believe people are pasting real data into this corporate black boxes.

What about Google Docs, Office 365, Github, AWS, Azure, Google Cloud, JIRA, Zendesk, etc? What is different about ChatGPT (if anything)?

Dont use any of it

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#217

Post by agloe_dreams »

mewpmewp2 wrote: post #214
agloe_dreams wrote: post #124

Earlier quoted context omitted.

Correct, but that level of security is expected from GitHub proper, they have all sorts of independent security reviews for their partners. Does all of that exist for Copilot?

Do you think Microsoft would dare to have Copilot with any less standards?

Counter: it already vomits all kinds of licensing issues everywhere, which somehow they didn’t really see coming…so yes?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#218

Post by nirav72 »

bsder wrote: post #153
osterbit2 wrote: post #132

Earlier quoted context omitted.

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

Do you really think the people asking ChatGPT to write their code can make that abstraction? The fact that the can't do this is the whole reason they have to use ChatGPT.

You can be an experienced developers with years building complex applications behind you and still find ChatGPT useful. I've found it useful for documenting individual methods or simply explaining my own/other's code or writing unit test methods or just using it to add boilerplate stuff that saves me an hour that I use elsewhere.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#219

Post by pama »

endisneigh wrote: post #186
hgsgm wrote: post #112

Earlier quoted context omitted.

Google had all the same problems, until it found a balance of functionality, security, and privacy. OpenAI just hasn't started to try adding privacy and security yet.

A language model inherently has a privacy problem. How would you guarantee no leaks?

You simply don’t train on the user imputs. There are enough unread books, public repos, and new articles.
Post reply on HN