Hacker News Reader

Comment by jsheard | Hacker News Reader

Apparently their TTS service is already back online, but more interesting is the original post about why the keys were revoked

https://rabbitu.de/articles/security-disclosure-1

tl;dr they had hardcoded their Elevenlabs admin keys into their client, which allowed anyone to access the entire history of TTS responses for every Rabbit R1 user

View on HN

They didn't hardcode it into the client (source: I have personally RE'd their client code[0]), they hardcoded it into their server-side code, which certain security researchers claim[1] to have (had) access to.

[0] https://gist.github.com/DavidBuchanan314/aafce6ba7fc49b19206...

[1] https://rabbitu.de/articles/security-disclosure-1

"rabbit inc has known that we have had their elevenlabs (tts) api key for a month, but they have taken no action to rotate the api keys."

oof

Oh this is bad. Real bad.

Is it? Did anyone take that product seriously?

Data breaches and leaks involving personal data is always bad.

Supposedly, ~130K customers did

Who knew there were that many people doing tech reviews on YT?

For who? The grifters who are about to get sued into bankruptcy, or the hipsters who bought into the snake oil and are now out $199?

I would rate this as a "well, anyway...".

> which allowed anyone to access the entire history of TTS responses

A lot of people are going to get scammed... again.

Was the key also able to be used to generate text to speech?

Reply on news.ycombinator.com