ChatGPT: Leaks passwords from private chats

According to complaints filed by an Ars reader on Monday, it appears that ChatGPT is leaking private conversations that include credentials and other personal details of unrelated users.

See also: ChatGPT – new features: Sees, hears, speaks!

Of the seven screenshots submitted by the reader, two stood out in particular. Both contained multiple username and password pairs that appeared to be related to a support system used by employees of a pharmaceutical prescription portal. An employee using the AI ​​chatbot appeared to be troubleshooting issues he encountered while using the portal.

In addition to the credentials, the leaked conversation reveals the name of the app the employee is referring to and the corresponding store number where the problem occurred.

The full conversation goes far beyond what is shown in the decrypted screenshot above. A link included by Ars reader Chase Whitesideshowed the conversation in its entirety. The URL revealed additional pairs of credentials.

The results appeared Monday morning shortly after reader Whiteside had used ChatGPT for an unrelated search.

According to Whiteside, “I went to ask a question (in this case, help with clever color names in a palette) and when I came back a little later, I noticed the additional conversations,” Whiteside wrote in an email. “They weren’t there when I used ChatGPT the night before last (I’m a fairly active user). No questions were asked – they just appeared in my history and are definitely not mine (and I don’t think they’re from the same user).”

See also: ChatGPT: Available again after a major outage

Other conversations leaked to Whiteside included the name of a presentation someone was preparing, details of unpublished research, and a script using the PHP programming language. The users in each conversation appeared to be different and unrelated. The conversation about the prescription portal included the year 2020. The dates did not appear in the other conversations.

This episode, and others like it, underscores the wisdom of removing personal details from questions asked on ChatGPT and other AI services whenever possible. Last March, OpenAI, the creator of ChatGPT, pulled the chatbot from service after a bug caused titles from an active user’s chat history to appear to unrelated users.

In November, researchers published a paper reporting how they used queries to induce ChatGPT to reveal email addresses, phone and fax numbers, physical addresses, and other personal data contained in material used to train the ChatGPT large language model.

Due to the risk of leaking proprietary or private data, companies including Appleare restricting the use of ChatGPT and similar sites by their employees.

As reported in an article from December, multiple people discovered that Ubiquity's UniFy devices were streaming private videos from unrelated users.

See also: ChatGPT: At the top of Wikipedia's list of most viewed pages

How can we secure digital conversations?

To secure digital conversations, one of the most effective ways is to use encryption. Encryption converts data into a form that can only be decrypted using a key. This means that even if someone manages to intercept the communication, they won't be able to read the conversation.

Additionally, it is important to regularly apply security updates and use the latest versions of chat apps. These updates often include fixes for security issues that have been discovered and could be exploited by attackers.

It is also important to be careful about the information we share in digital conversations. We should avoid sharing sensitive data, such as passwords, through messages. Finally, using password managers can help prevent password leaks. These tools generate and store strong passwords, allowing users to avoid entering passwords in their conversations.

Source: arstechnica