Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

cpomagazine.com

Post reply on HN
Print view View original

71–77 of 77 posts

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#71

Post by crimsontech »

SV_BubbleTime wrote: post #67
crimsontech wrote: post #59

Earlier quoted context omitted.

But the credentials are for stolen OpenAI logins, not stolen email logins. While there will be some people using the same password (I doubt many) the people selling them will no doubt have already validated and removed these from the set as they are obviously much more valuable.

> While there will be some people using the same password (I doubt many) Well, it’s clear you don’t work in IT.

Given that OpenAI is probably more poplar with people interested in technology I suspect most users would use a password manager and generate unique passwords. I work in security though so maybe I’m just surrounded by people that do.

I’ve combed through thousands of credential dumps to perform password stuffing attacks and the success rate is always very low.

I would be shocked if the sellers hadn’t already taken any credentials that work against the associated email account out before they listed the dumps for sale, given that email account access is way more valuable than access to someone’s OpenAI account.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#72

Post by Gigachad »

jackdh wrote: post #62
heyzk wrote: post #6

I'm curious about the logistics here, what's preventing OAI from obtaining a copy and invalidating those credentials?

Likely cheaper just to force everyone to change their password on login.

That would be pointless since the malware could just grab the new credentials.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#73

Post by flangola7 »

I_am_tiberius wrote: post #66
heyzk wrote: post #6

I'm curious about the logistics here, what's preventing OAI from obtaining a copy and invalidating those credentials?

OpenAI is run like a YC company. That means they do everything not to distract the user from the core workflow. I think privacy and security are just very low priority to them.

What is a YC company?

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#74

Post by jmye »

werrett wrote: post #50
jmye wrote: post #48

Earlier quoted context omitted.

I’m assuming that part of the issue is the crazy amount of internal company data people have been feeding into the thing. Finding your email password might let me see some memos, but if you’re not very thoughtful, you might’ve pushed all sorts of sensitive data into chat prompts. I don’t disagree with your premise otherwise, and grant that I might be racing to begin with.

Err, no. Compromising your email account will for sure be the worst outcome. Everything else, including your OpenAI account, are accessible via that email account + a password reset.

No, you're right. I was thinking about the kinds of sensitive information that one might get access to via a single account - not about the use of that account as an attack vector for other accounts.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#75

Post by bonestamp2 »

selcuka wrote: post #49
bonestamp2 wrote: post #24

Out of an abundance of caution, I just went to change my password... and I didn't see a way to change my password. I googled it and you have to log out and then choose "Forgot password?". Hope that saves someone some time.

Yes, that seems to be auth0's default password change story [1]. It's annoying and not expected from the so-called leader in authentication. [1] https://auth0.com/docs/authenticate/database-connections/pas...

Fair enough, but from a usability standpoint they could also have a "Change Password" link in your profile that just sends the same "Forgot Password" email and logs you out.

Re: 200k Compromised OpenAI Credentials Available for Purchase on the Dark Web

#76

Post by p1esk »

notnaut wrote: post #64
p1esk wrote: post #56

Earlier quoted context omitted.

Scaling FETs is not research?

It’s all research - it’s just that when you get a taste of the money, the trend is often to lean heavy towards more of it. Wasteful, frivolous curiosity often falls into the rear view.

There are not a lot of places where you can pursue "wasteful and frivolous curiosity". And even at those places, you would need to have earned the privilege.
Post reply on HN