7 ms·

There is some essential context missing from this screenshot to understand what is going on and if it's significant or not. Where is ChatGPT getting the informa

by yosito 3y ago

There is some essential context missing from this screenshot to understand what is going on and if it's significant or not. Where is ChatGPT getting the information about which email account to hack? That has to be provided either to the Wuzzi webpage, or to WebPilot or directly to ChatGPT somewhere. I noticed recently while developing a ChatGPT plugin that the HTTP requests that the plugin makes happen directly in my browser, and not on an OpenAI server. The implication, as far as I can tell, is that the Wuzzi webpage is somehow stealing some authentication token or something from your browser if you're logged into your email. Definitely a plausible attack vector, but I'd like to know more.

wunderwuzzi23 3y ago
Its the other plugin that has the authentication token to the emails (it's part of setup if you use certain plugins). So its not CSRF, but a confused deputy problem with plugins, Cross Plugin Request Forgery for lack of a better term.
- yosito 3y ago
  It generally seems like a bad idea to give a plugin an authentication token if it's in a shared environment with an untrusted plugin. Maybe obvious to a typical HN reader, but probably something OpenAI should mitigate or warn about before plugins go public. Plugins probably need some kind of permission model for accessing credentials, and the UI could surface warnings when activating credentialed plugins together with other plugins in the same environment. And any plugin that uses credentials, should have some kind of "Approve/Deny" dialog each time it executes. As a side note, I was using the letters CRSF as the internal name for the plugin I'm testing, so reading CSRF is messing with my brain.
  - exitb 3y ago
    It's usually ok for humans to have access to stuff and still roam the internet freely, because most humans in such position have enough common sense. What was described in the OP is basically a successful phishing attempt and it turns out that LLMs are terribly susceptible to that. I can't imagine a human employee needing a sign off every time they need to access their e-mail. It has to be solved for LLMs in a way that doesn't impose such limitations either.

by yosito 3y ago

wunderwuzzi23 3y ago

Its the other plugin that has the authentication token to the emails (it's part of setup if you use certain plugins). So its not CSRF, but a confused deputy problem with plugins, Cross Plugin Request Forgery for lack of a better term.

yosito 3y ago
It generally seems like a bad idea to give a plugin an authentication token if it's in a shared environment with an untrusted plugin. Maybe obvious to a typical HN reader, but probably something OpenAI should mitigate or warn about before plugins go public. Plugins probably need some kind of permission model for accessing credentials, and the UI could surface warnings when activating credentialed plugins together with other plugins in the same environment. And any plugin that uses credentials, should have some kind of "Approve/Deny" dialog each time it executes. As a side note, I was using the letters CRSF as the internal name for the plugin I'm testing, so reading CSRF is messing with my brain.
- exitb 3y ago
  It's usually ok for humans to have access to stuff and still roam the internet freely, because most humans in such position have enough common sense. What was described in the OP is basically a successful phishing attempt and it turns out that LLMs are terribly susceptible to that. I can't imagine a human employee needing a sign off every time they need to access their e-mail. It has to be solved for LLMs in a way that doesn't impose such limitations either.