Hacker News Reader

Comment by TheRealPomax | Hacker News Reader

A ChatGPT account has your email address, and a password, so unless folks are using ChatGPT to discuss their personal information against the warning you get every single time you log in, this is mostly just more proof that everything you log into will be hacked. Which isn't really news. Unfortunately, what it's not is an article that explains how "what they got" translates into "and this is what they could do with that data", so I'm not sure I understand the value of this data. What ramifications would this have for folks whose account got compromised?

View on HN

If people use the same email and password to log into other services, then those might get compromised also.

By now no one "should" be using the same password for multiple services, but it most likely still happens

That's a given. What ramifications are there for this data rather than just the generic "if you're still dumb enough to recycle passwords, you're going to find out why people keep telling you not to". What can the data in these logs actually be used for?

Because as far as credential hacks go, 100.000 users is nothing, you can trivially get password lists thousands of times bigger than that on any given day of the week.

Using the same email is almost certain. I know that we can do at least user+mod@domain, but how many people are actually using that?

All the security is in the password. Using a password manager to automatically generate and store password almost fixes that. Then there are services that insist using 8 to 16 character passwords :shrug

I've been "hiding my email" with iCloud+ more and more. The drawback is that now I don't know my password and email address for some of my services.

What if I used the 'sign in with google'? Should i be changing my google password?

Unlikely, auth mediation never gives out your password as part of logging into some service, it gets asks to confirm you are logged in and if so, to issue a temporary auth tokens that acts as proof that Google thinks your session is authenticated. So if you explicitly log out, then that token should get invalidated, and logging back in should yield a new auth token.

No. That is simply a token containing some claims sayings you are you, no passwords or anything like that is transferred. Having said that; it is still best practice to set up MFA for all your accounts.

What's really wild is you can't even reset your password without going through the forgot password flow from the login screen.

They don't even have basics here.

MFA? Not even an option, even though they're using Auth0 and Auth0 can do that.

I asked for passkeys and got silence back. It’s two check boxes in the Auth0 tenant config (I manage an Auth0 tenant).

Why do I suspect their sysadmin is one person working half time?

Ask ChatGPT to enable those check boxes and see what happens.

maybe if your billing information is saved they could use your account to create api keys to other services and sell that.

not sure if the billing info from chatgpt is entered on the same place

Reply on news.ycombinator.com