Furry Technologists

1314 readers

1 users here now

Science, Technology, and pawbs

founded 1 year ago

MODERATORS

Soatok@pawb.social

stefenauris@pawb.social

OpenAI’s ChatGPT Mac app was storing conversations in plain text (www.theverge.com)

submitted 4 months ago by stefenauris@pawb.social to c/tech@pawb.social

10 comments fedilink hide all child comments

Oops

you are viewing a single comment's thread
view the rest of the comments

[–] henfredemars@infosec.pub 5 points 4 months ago (2 children)

I’m a little confused. If the conversations weren’t stored in plain text, wouldn’t the key have to be stored on your computer also? Isn’t that plain text with extra steps?

[–] black0ut@pawb.social 10 points 4 months ago (1 children)

Depends on the system, but normally, the OS provides a way to encrypt a file using the user credentials. It's completely seamless while the user is logged in and using the computer. It's true that any program running with the user privileges and within its session can open the file, but once the user logs out it's unreadable.

[–] pivot_root@lemmy.world 6 points 4 months ago* (last edited 4 months ago)

With MacOS, specifically, it's stupidly easy and unintrusive to enable disk encryption. Outside of that, programs can save key-value pairs to Keychain (a credential store) and use that to store a randomly-generated encryption key.

It's true that any program running with the user privileges and within its session can open the file, but once the user logs out it's unreadable.

If the data was saved to the login Keychain, it should only be accessible while that specific user is logged in. The existence of vulnerabilities notwithstanding, it should actually be reasonably secure as long as System Integrity Protection is enabled and the program in question isn't running. SIP stops users (including root) from messing with system files or processes, and the Keychain requires a user password prompt to give programs access to entries created by other programs.

Now, considering all the above... it would have taken a day at most to figure out how to encrypt the data before it gets written to the file so it's not just sitting completely out in the open.