3 ms·

Apparently their TTS service is already back online, but more interesting is the original post about why the keys were revoked https://rabbitu.de/articles/secu

Apparently their TTS service is already back online, but more interesting is the original post about why the keys were revoked https://rabbitu.de/articles/security-disclosure-1 https://rabbitu.de/articles/security-disclosure-1 tl;dr they had hardcoded their Elevenlabs admin keys into their client, which allowed anyone to access the entire history of TTS responses for every Rabbit R1 user

Fabricio20 2y ago
Oh this is bad. Real bad.
- wepple 2y ago
  Is it? Did anyone take that product seriously?
  - bayindirh 2y ago
    Data breaches and leaks involving personal data is always bad.
    - RIMR 2y ago
      [flagged]
  - Retr0id 2y ago
    Supposedly, ~130K customers did
    - dghlsakjg 2y ago
      Who knew there were that many people doing tech reviews on YT?
- RIMR 2y ago
  For who? The grifters who are about to get sued into bankruptcy, or the hipsters who bought into the snake oil and are now out $199? I would rate this as a "well, anyway...".
pram 2y ago
"rabbit inc has known that we have had their elevenlabs (tts) api key for a month, but they have taken no action to rotate the api keys." oof
lawlessone 2y ago
> which allowed anyone to access the entire history of TTS responses A lot of people are going to get scammed... again.
jamesy0ung 2y ago
Was the key also able to be used to generate text to speech?
Retr0id 2y ago
They didn't hardcode it into the client (source: I have personally RE'd their client code[0]), they hardcoded it into their server-side code, which certain security researchers claim[1] to have (had) access to. [0] https://gist.github.com/DavidBuchanan314/aafce6ba7fc49b19206bd2ad357e47fa https://gist.github.com/DavidBuchanan314/aafce6ba7fc49b19206... [1] https://rabbitu.de/articles/security-disclosure-1 https://rabbitu.de/articles/security-disclosure-1