6 ms·
In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You co
by burkaman 9mo ago
In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file. If anything you might be more successful this way, because a .md file feel less suspicious than a .docx.
- fragmede 9mo agoMind you, that opinion isn't universal. For programmer and programmer-adjacent technically minded individuals, sure, but there are still places where a pdf for a resume over docx is considered "weird". For those in that bubble, which ostensibly this product targets, md files are what hackers who are going to steal my data use.
- burkaman 9mo agoYeah I guess I meant specifically for the population that uses LLMs enough to know what skills are.
- reactordev 9mo agoThis is why I use signed PDF’s. If a recruiter or manager asks for a docx, I move on. You’re only going to ever get a read only version.
- w-ll 9mo agoCare to share your resume? I've built PDF scanning tech before the rise of llms, OCR at the very least will defeat this.
- jagged-chisel 9mo agoAre you talking about defeating digital signatures?
- reactordev 9mo agoMark-I eyeball is totally capable.
- pluralmonad 9mo agoRead-only... Until I ctrl-p in Firefox.
- reactordev 9mo agoYou can’t open it in a browser. It requires a proper PDF viewer.
- jkaplowitz 9mo agoAll PDF security can be stripped by freely available software in ways that allow subsequent modifications without restriction, except the kind of PDF security that requires an unavailable password to decrypt to view, but in that case viewing isn’t possible either. Subsequent modifications would of course invalidate any digital signature you’ve applied, but that only matters if the recipient cares about your digital signature remaining valid. Put another way, there’s no such thing as a true read-only PDF if the software necessary to circumvent the other PDF security restrictions is available on the recipient’s computer and if preserving the validity of your digital signature is not considered important. But sure, it’s very possible to distribute a PDF that’s a lot more annoying to modify than your private source format. No disagreement there.
- reactordev 9mo agoYou think a recruiter will be a forensic security researcher? Having document level digital signature is enough for 99% of use cases. Most software that a consumer would have respects the signature and prevents any modifications. Sure, you could manually edit the PDF to remove the document signature security and hope that the embedded JavaScript check doesn’t execute…
- jkaplowitz 9mo agoNothing that hard. When I had a technically similar need (for non-shady purposes unrelated to recruiting) I found easy installable free GUI software for Windows that worked just fine with a simple Google search. No specialist expertise needed. Yes, most consumer software does respect what you say. But it’s easy for a minimally motivated consumer to obtain and use software which doesn’t. However, the context we were discussing was neither a consumer nor a forensic security researcher, but a recruiter trying to do shady things with a resume. I don't expect them to be a specialist, but I do expect them to be able either to get the kind of software I just described with a security stripping feature, or else to have access to third-party software specifically targeting the recruiter market that will do the shady things - including to digitally signed PDFs like yours - without them having to know how it works.
- 9mo ago
- ajxs 9mo agoWhat is this measure defending against (other than getting a job)? The recruiter can still extract the information in your signed PDF, and send their own marked-up version to the client in whatever format they like. Their request for a Word document is just to make that process easier. Many large companies even mandate that recruitment agencies strip all personally-identifiable information out of candidates' resumes[1], to eliminate the possibility of bias. 1: I wish they didn't, because my Github is way more interesting than my professional experience.
- cyanydeez 9mo agoThe smart bear versus the unopenable trashcan.
- butlike 9mo agoWhat's the point of the analogy? That the bear just moves on? Genuine question; I've never heard this one before.
- burkaman 9mo agoPossibly apocryphal quote from a Yosemite park ranger talking about the difficulty of designing a trash can that a bear can't open but a human can: "There is considerable overlap between the intelligence of the smartest bears and the dumbest tourists." - https://yro.slashdot.org/comments.pl?sid=191810&cid=15757347 https://yro.slashdot.org/comments.pl?sid=191810&cid=15757347 (earliest instance of it I can find) I don't really follow the analogy here to be honest.
- cyanydeez 9mo agoThe analogy is that AI is suppose to be able to do _What humans do_ but better. But you also want AI to be more secure. To make it more secure, you'll have to prevent the user from doing things _they already do_. Which is impossible. The current LLM AI/Agent race is a non-deterministic GIGO and will never be secure because it's fundamentally about mimicing humans who are absolutely not secure.
- rirze 9mo agoProbably referring to the rat's race between making trash cans hard for bears to tamper but usable for tourists. The analogy is probably implying there is considerable overlap between the smartest average AI user and the dumbest computer-science-related professional. In this case, when it comes to, "what is this suspicious file?". Which I agree.
- bandrami 9mo agoIsn't one of the main use cases of Cowork "summarize this document I haven't read for me"?
- zombot 9mo agoOnce again demonstrating that everything comes at a cost. And yet people still believe in a free lunch. With the shit you get people to do because the label says AI I'm clearly in the wrong business.
- azan_ 9mo agoThere are tons of free lunches everywhere though.
- butlike 9mo agoName one.
- richardw 9mo agoDebian. Linux. Http protocol.
- addaon 9mo agoWild blueberries. Yum.
- array_key_first 9mo agoAlmost all of human advancement? Medicine, vaccines, the printing press, domesticating crops, moving water around...
- raincole 9mo ago> because a .md file feel less suspicious than a .docx For a programmer? I bet 99.9% people won't consider opening a .docx or .pdf 'unsafe.' Actually, an average white-collar workers will find .md much more suspicious because they don't know what it is while they work with .docx files every day.
- nine_k 9mo agoMost IT departments educate users about the dangers of macros in MS Office files of suspicious provenance. The instruction may be in a .txt file, which is usually deemed safe and inert by construction.
- behnamoh 9mo ago> an average white-collar workers will find .md much more suspicious *.dmg files on macOS are even worse! For years I thought they'd "damage" my system...
- mock-possum 9mo agoIt was a rather unfortunate choice of extension
- arghwhat 9mo ago> For years I thought they'd "damage" my system... Well, would you argue that the office apps you installed from them didn't cause you damage, physically or emotionally?
- leokennis 9mo ago> an average white-collar workers will find .md much more suspicious because they don't know what it is while they work with .docx files every day I think the truly average white collar worker more or less blindly clicks anything and everything if they think it will make their work/life easier...
- RCitronsBroker 9mo agojust tell em .md stands for mortgage debater
- rpigab 9mo agoPeople trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities. You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.
- snoman 9mo agoBut nobody trusts AI. Whenever I leave my circle of engineering people and am along the general public, I hear nothing but contempt for it.
- munk-a 9mo agoI will never stop being disappointed that we have an API to control the clipboard. There is no use of this that I have ever found beneficial as a user.