4 ms·

A ChatGPT account has your email address, and a password, so unless folks are using ChatGPT to discuss their personal information against the warning you get ev

A ChatGPT account has your email address, and a password, so unless folks are using ChatGPT to discuss their personal information against the warning you get every single time you log in, this is mostly just more proof that everything you log into will be hacked. Which isn't really news. Unfortunately, what it's not is an article that explains how "what they got" translates into "and this is what they could do with that data", so I'm not sure I understand the value of this data. What ramifications would this have for folks whose account got compromised?

McDyver 3y ago
If people use the same email and password to log into other services, then those might get compromised also. By now no one "should" be using the same password for multiple services, but it most likely still happens
- wing-_-nuts 3y ago
  What if I used the 'sign in with google'? Should i be changing my google password?
  - TheRealPomax 3y ago
    Unlikely, auth mediation never gives out your password as part of logging into some service, it gets asks to confirm you are logged in and if so, to issue a temporary auth tokens that acts as proof that Google thinks your session is authenticated. So if you explicitly log out, then that token should get invalidated, and logging back in should yield a new auth token.
  - moi2388 3y ago
    No. That is simply a token containing some claims sayings you are you, no passwords or anything like that is transferred. Having said that; it is still best practice to set up MFA for all your accounts.
- TheRealPomax 3y ago
  That's a given. What ramifications are there for this data rather than just the generic "if you're still dumb enough to recycle passwords, you're going to find out why people keep telling you not to". What can the data in these logs actually be used for? Because as far as credential hacks go, 100.000 users is nothing, you can trivially get password lists thousands of times bigger than that on any given day of the week.
- pmontra 3y ago
  Using the same email is almost certain. I know that we can do at least user+mod@domain, but how many people are actually using that? All the security is in the password. Using a password manager to automatically generate and store password almost fixes that. Then there are services that insist using 8 to 16 character passwords :shrug
  - deleted 3y ago
    [deleted]
  - bunga-bunga 3y ago
    I've been "hiding my email" with iCloud+ more and more. The drawback is that now I don't know my password and email address for some of my services.
slowmovintarget 3y ago
What's really wild is you can't even reset your password without going through the forgot password flow from the login screen. They don't even have basics here. MFA? Not even an option, even though they're using Auth0 and Auth0 can do that.
- toomuchtodo 3y ago
  I asked for passkeys and got silence back. It’s two check boxes in the Auth0 tenant config (I manage an Auth0 tenant).
  - minedwiz 3y ago
    Why do I suspect their sysadmin is one person working half time?
  - starttoaster 3y ago
    Ask ChatGPT to enable those check boxes and see what happens.
kobalsky 3y ago
maybe if your billing information is saved they could use your account to create api keys to other services and sell that. not sure if the billing info from chatgpt is entered on the same place

McDyver 3y ago

If people use the same email and password to log into other services, then those might get compromised also. By now no one "should" be using the same password for multiple services, but it most likely still happens

wing-_-nuts 3y ago
What if I used the 'sign in with google'? Should i be changing my google password?
- TheRealPomax 3y ago
  Unlikely, auth mediation never gives out your password as part of logging into some service, it gets asks to confirm you are logged in and if so, to issue a temporary auth tokens that acts as proof that Google thinks your session is authenticated. So if you explicitly log out, then that token should get invalidated, and logging back in should yield a new auth token.
- moi2388 3y ago
  No. That is simply a token containing some claims sayings you are you, no passwords or anything like that is transferred. Having said that; it is still best practice to set up MFA for all your accounts.
TheRealPomax 3y ago
That's a given. What ramifications are there for this data rather than just the generic "if you're still dumb enough to recycle passwords, you're going to find out why people keep telling you not to". What can the data in these logs actually be used for? Because as far as credential hacks go, 100.000 users is nothing, you can trivially get password lists thousands of times bigger than that on any given day of the week.
pmontra 3y ago
Using the same email is almost certain. I know that we can do at least user+mod@domain, but how many people are actually using that? All the security is in the password. Using a password manager to automatically generate and store password almost fixes that. Then there are services that insist using 8 to 16 character passwords :shrug
- deleted 3y ago
  [deleted]
- bunga-bunga 3y ago
  I've been "hiding my email" with iCloud+ more and more. The drawback is that now I don't know my password and email address for some of my services.

slowmovintarget 3y ago

What's really wild is you can't even reset your password without going through the forgot password flow from the login screen. They don't even have basics here. MFA? Not even an option, even though they're using Auth0 and Auth0 can do that.

toomuchtodo 3y ago
I asked for passkeys and got silence back. It’s two check boxes in the Auth0 tenant config (I manage an Auth0 tenant).
- minedwiz 3y ago
  Why do I suspect their sysadmin is one person working half time?
- starttoaster 3y ago
  Ask ChatGPT to enable those check boxes and see what happens.

kobalsky 3y ago

maybe if your billing information is saved they could use your account to create api keys to other services and sell that. not sure if the billing info from chatgpt is entered on the same place