Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

cpomagazine.com

Post reply on HN
Print view View original

61–70 of 77 posts

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#61

Post by owl57 »

lolinder wrote: post #39
omeze wrote: post #33

Earlier quoted context omitted.

It's not requiring logins per se -- this is the second mishap I'm aware of related to their consumer product surface area (the first being users' chat data going to other users). Just seems like a distraction, if the goal is to do fundamental AI research.

I think you're missing the point: this isn't a mishap that has anything to do with OpenAI. If you are a company that has usernames and passwords, then your login information is for sale because your customers have malware on their computers. OpenAI didn't do anything wrong here besides have a ton of users, many of which had malware on their computers. From the article: > However, the ChatGPT parent company clarified…

> If you are a company that has usernames and passwords

> didn't do anything wrong here besides have a ton of users

Passwords aren't a trivial part of this. OpenAI offers login with Google/Apple/MS. Managing their own passwords as well wasn't a mandatory part of the product, but a trade off: they probably got more users, but also more complexity and risks.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#63

Post by lolinder »

crimsontech wrote: post #59
werrett wrote: post #50

Earlier quoted context omitted.

Err, no. Compromising your email account will for sure be the worst outcome. Everything else, including your OpenAI account, are accessible via that email account + a password reset.

But the credentials are for stolen OpenAI logins, not stolen email logins. While there will be some people using the same password (I doubt many) the people selling them will no doubt have already validated and removed these from the set as they are obviously much more valuable.

I think they were just responding to OP's dismissal of leaked email credentials as a major threat vector:

> Finding your email password might let me see some memos, but ...

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#64

Post by notnaut »

p1esk wrote: post #56
omeze wrote: post #38

Earlier quoted context omitted.

That's my worry, too. I'm reminded of the history of Intel, which at its founding decided that it would not have a research org (drop the R from R&D) and just focus on scaling FETs, because the founders learned that trying to do both meant that one would ultimately suffer.

Scaling FETs is not research?

It’s all research - it’s just that when you get a taste of the money, the trend is often to lean heavy towards more of it. Wasteful, frivolous curiosity often falls into the rear view.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#65

Post by I_am_tiberius »

bonestamp2 wrote: post #24

Out of an abundance of caution, I just went to change my password... and I didn't see a way to change my password. I googled it and you have to log out and then choose "Forgot password?". Hope that saves someone some time.

It's unbelievable.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#66

Post by I_am_tiberius »

heyzk wrote: post #6

I'm curious about the logistics here, what's preventing OAI from obtaining a copy and invalidating those credentials?

OpenAI is run like a YC company. That means they do everything not to distract the user from the core workflow. I think privacy and security are just very low priority to them.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#67

Post by SV_BubbleTime »

crimsontech wrote: post #59
werrett wrote: post #50

Earlier quoted context omitted.

Err, no. Compromising your email account will for sure be the worst outcome. Everything else, including your OpenAI account, are accessible via that email account + a password reset.

But the credentials are for stolen OpenAI logins, not stolen email logins. While there will be some people using the same password (I doubt many) the people selling them will no doubt have already validated and removed these from the set as they are obviously much more valuable.

> While there will be some people using the same password (I doubt many)

Well, it’s clear you don’t work in IT.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#68

Post by SV_BubbleTime »

owl57 wrote: post #61
lolinder wrote: post #39

Earlier quoted context omitted.

I think you're missing the point: this isn't a mishap that has anything to do with OpenAI. If you are a company that has usernames and passwords, then your login information is for sale because your customers have malware on their computers. OpenAI didn't do anything wrong here besides have a ton of users, many of which had malware on their computers. From the article: > However, the ChatGPT parent company clarified…

> If you are a company that has usernames and passwords > didn't do anything wrong here besides have a ton of users Passwords aren't a trivial part of this. OpenAI offers login with Google/Apple/MS. Managing their own passwords as well wasn't a mandatory part of the product, but a trade off: they probably got more users, but also more complexity and risks.

Federation has a privacy risk, and I fully support non-federated logins.

But still no, a malware thst grabs passwords doesn’t mean you can blame a company for using passwords.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#69

Post by [deleted] »

lolinder wrote: post #63
crimsontech wrote: post #59

Earlier quoted context omitted.

But the credentials are for stolen OpenAI logins, not stolen email logins. While there will be some people using the same password (I doubt many) the people selling them will no doubt have already validated and removed these from the set as they are obviously much more valuable.

I think they were just responding to OP's dismissal of leaked email credentials as a major threat vector: > Finding your email password might let me see some memos, but ...

[deleted]

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#70

Post by somsak2 »

I_am_tiberius wrote: post #66
heyzk wrote: post #6

I'm curious about the logistics here, what's preventing OAI from obtaining a copy and invalidating those credentials?

OpenAI is run like a YC company. That means they do everything not to distract the user from the core workflow. I think privacy and security are just very low priority to them.

Are YC-associated companies known for disregarding privacy and security? Haven't heard much about breaches / violations from their toplist https://www.ycombinator.com/topcompanies/valuation
Post reply on HN