Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

231–240 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#231

Post by capybara_2020 »

cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

I am curious, do you block MS Edge? It has a grammar check for all input boxes that sends data to MS servers to check. Similar to what Grammarly does.

MS also "helpfully" asks you if you want to use that enhanced grammar check in MS Word(as far as I have seen, might be there in other office products too). I cannot imagine sending all my documents to MS. But I am not sure most users will realize what is happening.

All these companies offer helpful services but are hovering up data and no one knows the consequences yet. It feels like ChatGPT is just one symptom of a bigger problem.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#232

Post by pama »

chrismorgan wrote: post #198
beiller wrote: post #143

Earlier quoted context omitted.

I did not verify this regex, on the very surface scan seems OK: ./main -m ./models/7B/ggml-model-q4_0.bin -t 4 --temp 0.7 --top_k 40 --top_p 0.5 --repeat_last_n 256 --repeat_penalty 1.17647 -n 1024 -p $'Here is a handy short form regex to validate an email address: ' Here is a handy short form regex to validate an email address: ^([a-zA-Z0-9_.+-]+@[a-zA-Z0-9.-]+\.[a-z\.]{2,6})+$ The first character can be either uppe…

Badly wrong, in part because your prompt was badly wrong, because there is no short regex to validate an email address. (It needs a way of saying “I can’t complete that because the prompt makes no sense for this reason”.) What it emitted accepts a large number of invalid addresses (due to things like not checking dot placement, and the inexplicable (…)+ wrapping around the entire thing), and doesn’t accept a large nu…

For comparison GPT-4 provides the following Python regex and then warns that it does not catch all edge cases and that it’s better to use a dedicated library like email-validator:

email_pattern = r"^(?=.{1,256})(?=.{1,64}@.{1,255}$)(?=\S)(?:(?!@)[\w&'+._%-]+(?:(?(?<=\S)@((?=\S)(?!-)[A-Za-z0-9-]{1,63}(?<!-)\.?)+[A-Za-z]{2,19}(?<=\S)$"

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#233

Post by waboremo »

FartyMcFarter wrote: post #229
waboremo wrote: post #123

Earlier quoted context omitted.

Sticking it in your own datacenter doesn't really prevent any of these problems (except maybe #2), only now your leaks are internal and because of all the false sense of security, you might wind up leaking far more confidential and specific information (ie. an executive leaking to the rest of the team in advance that they are planning layoffs for noted reasons, whereas that executive might have used more vague terms…

It prevents all of those problems as it puts all the data / data movement under your control.

How so?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#234

Post by roflyear »

comment_ran wrote: post #24
cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

If your competitor use ChatGPT to compete with you and they're 10x productive than yours, are you still willing to insist? If the productive is 100x, will you?

Man the fanboyism is out of control here.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#236

Post by roflyear »

pedrosorio wrote: post #66
chaxor wrote: post #48

Earlier quoted context omitted.

[flagged]

> Think about how long it's taken tools like pandas to reach the point that it is now. That entire package can be built to the level it is now in a couple of days. I am having trouble parsing this statement. You're saying a person equipped with chatGPT trained on data prior to December 2007 (the month before the initial pandas release) could have put together the entire pandas library in a couple of days? That seems…

They couldn't even do it today with pandas being in the training set. People are being crazy about this tech.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#237

Post by faeriechangling »

jedberg wrote: post #114

No one cares about security because there is no consequence for getting it wrong. Look at all the major breaches ever. And look specifically at the stock price of those companies. They took small short term hits at best. Worst case the CISO gets fired and then they all play musical chairs and end up in new roles. Heck, even Lastpass, ostensibly a security company , doesn't seem particularly affected by their breach.…

I don't even agree to begin with the idea that a tool that vastly increases your productivity is a security risk in the grand scheme of things, since you know, you can just allocate the time you were spending before on writing boilerplate towards securing systems.

Endpoint security software is a security risk too.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#238

Post by FartyMcFarter »

waboremo wrote: post #233
FartyMcFarter wrote: post #229

Earlier quoted context omitted.

It prevents all of those problems as it puts all the data / data movement under your control.

How so?

Because it's your own data center, which means you own the data and can set up firewall rules to prevent any software running there from leaking data to outside the data center.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#239

Post by throwawaysleep »

ChatPGT wrote: post #164
osterbit2 wrote: post #132

Earlier quoted context omitted.

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

I'm doing that since day one. I can't believe people are pasting real data into this corporate black boxes.

I simply don't give a crap if my employer loses data. I don't care if my carelessness costs my employer a billion bucks down the line as I won't be working for them next year.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#240

Post by lazyasciiart »

capybara_2020 wrote: post #231
cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

I am curious, do you block MS Edge? It has a grammar check for all input boxes that sends data to MS servers to check. Similar to what Grammarly does. MS also "helpfully" asks you if you want to use that enhanced grammar check in MS Word(as far as I have seen, might be there in other office products too). I cannot imagine sending all my documents to MS. But I am not sure most users will realize what is happening. All…

You can disable the feature entirely in group policies, I imagine organizations with a decent IT org will do so before deploying the update.
Post reply on HN