Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

331–340 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#331

Post by MattPalmer1086 »

raincole wrote: post #134
wantsanagent wrote: post #78

We saw these same fears with the release of Gmail. Why would you trust your email to Google?!! Aren't they going to train their spam filters on all your data? Aren't they going to sell it, or use it to sell you ads? Corporations constantly put their most sensitive data in 3rd party tools. The executive in the article was probably copying his company strategy from Google docs. Yes, there are good reasons for concern,…

If your company's code is all repositories on Github (or bitbucket, or any similar service), worrying about ChatGPT is quite silly. And on the other hand, if your company doens't use Github etc due to security concern, it's a very good sign telling you need to ban ChatGPT too.

No, it's not silly to worry about it. Many companies store data in third party systems to which they retain control over access. Once you put data into chatGPT what control do you have over it?

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#332

Post by clbrmbr »

TeMPOraL wrote: post #313
l33tman wrote: post #307

Earlier quoted context omitted.

Doesn't OpenAI explicitly say that your Q/A on the free ChatGPT are stored and sent to human reviewers to be put in their RL database? Now of course we can't be sure what google, AWS etc do with the data on disks there, but it would be a pretty big scandal if some whistleblower eventually comes out and say that google employees sit and laugh at private bucket contents on GCP or private Google Docs. So there's a diffe…

Who in their right mind is using free ChatGPT through that shitty no good web interface of theirs, that can barely handle two queries-and-replies before grinding down to a halt? Surely everyone is using the pay-as-you-go API keys and any one of the alternative ffrontends or integrations? And, IIRC, pay-as-you-go API requests are explicitly not used for training data. I'm sad GPT-4 isn't there yet - except for those w…

I wonder what the distribution of tokens / sec at OpenAI is between the free ChatGPT, paid ChatGPT, and APIs. I’d have to think the free interface is getting slammed. Quite the scaling project, and still nowhere near peaking.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#333

Post by TeMPOraL »

epups wrote: post #320
TeMPOraL wrote: post #313

Earlier quoted context omitted.

Who in their right mind is using free ChatGPT through that shitty no good web interface of theirs, that can barely handle two queries-and-replies before grinding down to a halt? Surely everyone is using the pay-as-you-go API keys and any one of the alternative ffrontends or integrations? And, IIRC, pay-as-you-go API requests are explicitly not used for training data. I'm sad GPT-4 isn't there yet - except for those w…

It's really funny to see these types of comments. I would assume a vast majority of users are using the Web interface, particularly in a corporate context where an account for the API could take ages or not be accepted. If people were smart and performed according to best practices, articles like this one would not be necessary.

I mean, if you're using a free web interface in corporate context, you may just as well use a paid API with your personal account - either way, you're using it of your own volition, and not as approved by your employer. And getting API keys to ChatGPT equivalent (i.e. GPT-3.5) takes... a minute, maybe less.

I am honestly confused how people can use this thing with the interface OpenAI runs. The app has been near-unusable for me, for months, on every device I tried it on.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#334

Post by TeMPOraL »

flangola7 wrote: post #321
TeMPOraL wrote: post #316

Earlier quoted context omitted.

I imagine they must be. I'm habitually careful to either click on a link, paste the entirety of the internal URL at once, or enter only the most generic word or words that will surface the URL I want as a history suggestion - all to minimize the chances of leaking anything this way.

You can turn the auto search off

There's a lot of things that you can turn off, but nobody actually does - which is the very reason they ship turned on in the first place.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#335

Post by strus »

yathrowaway01 wrote: post #81
JohnFen wrote: post #63

Earlier quoted context omitted.

There's a dev here who is using ChatGPT extensively in his work. The rest of the team is just waiting for him to get caught and fired. Sharing company data with unapproved external entities is very definitely a firing offense.

Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.

> If you think your code is special then you're wrong

Your code is not special, but customers data may be. Also, some companies needs to comply to various certifications, and proven leak of source code that was put into some third party tool may be a reason to revoke such certification. Which can cause a serious financial harm to a given company, as it can lead to ex. losing government clients.

This is just the tip of the iceberg.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#336

Post by strus »

bob1029 wrote: post #294
KirillPanov wrote: post #287

Earlier quoted context omitted.

> in many areas of TSMC, smart phones are banned This does not surprise me at all . What I want to know is how they enforce it. Unless they have something better than "fear of somebody seeing you using the smartphone", it isn't getting enforced. If they do have something better I want to know what.

At Samsung, you typically walk through multiple sets of metal detectors and security before you can actually get into the fab. Anyone working in an office area can have a phone but they do some... stuff to it.

> they do some... stuff to it.

They put a special sticker on all of your cameras and inspect if it is still there on the exit.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#337

Post by HeavyStorm »

probablynish wrote: post #104
cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

This really depends on the cost/benefit tradeoff for the entity in question. If using ChatGPT makes you X% more productive (shipping faster / lowers labor costs / etc), but comes with Y% risk of data leakage, is that worth it in expectation or not? I would argue that there definitely exist companies for which it's worth the tradeoff. By the way, OpenAI says they wont use data submitted through its API for model train…

You've certainly not worked with _real_ sensitive data. The kind that can bankrupt your business.

I do and if it could be leaked through ChatGPT I would have it blocked.

Risk isn't a single dimension, it's a combination of exposure (chance of happening) and impact (how much will you lose)

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#338

Post by avisser »

goatlover wrote: post #302
throwawaysleep wrote: post #239

Earlier quoted context omitted.

I simply don't give a crap if my employer loses data. I don't care if my carelessness costs my employer a billion bucks down the line as I won't be working for them next year.

Why don’t you feel any responsibility?

Not who you replied to, but if you agree, even a little, with the phrase, "the social contract between employees & employers is broken in the US"... well it goes both ways.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#339

Post by famouswaffles »

ben_w wrote: post #272
famouswaffles wrote: post #173

Earlier quoted context omitted.

Nope. LLMs don't use the internet for inference at all unless you give it access to a web search api or something like that. chtGPT is just too massive to run on any local machine. But make no mistake, it does not require the internet.

I didn't say "for inference", and neither did the person I replied to. GPT uses the internet to connect to users, but rather more importantly chatGPT in particular has a layer on top of GPT which is trained from human feedback. Keywords search "RLHF". That feedback mechanism is, if anything, becoming more detailed as time passes, so I must infer that it's still considered highly important, probably even for the 3.5 m…

The model isn't being trained as time goes on.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#340

Post by ben_w »

famouswaffles wrote: post #339
ben_w wrote: post #272

Earlier quoted context omitted.

I didn't say "for inference", and neither did the person I replied to. GPT uses the internet to connect to users, but rather more importantly chatGPT in particular has a layer on top of GPT which is trained from human feedback. Keywords search "RLHF". That feedback mechanism is, if anything, becoming more detailed as time passes, so I must infer that it's still considered highly important, probably even for the 3.5 m…

The model isn't being trained as time goes on.

The RLHF layer is, and that layer is important.

That it does any of this is the specific reason for the story you're commenting on, and why putting data into it isn't like putting the same data into e.g. a Google Docs spreadsheet.

Post reply on HN