ChatGPT est un service opéré par OpenAI pour qui il faut un compte chez eux pour y accéder. Les comptes en question sont des comptes managés par OpenAI donc permettant aussi d’accéder aux API des autres solutions (Dall-E, GPT, etc), aux crédits associé, etc.

Dissocier ChatGPT et OpenAI sur la gestion du compte reviendrait à dire qu’une adresse Gmail n’est pas gérée par un compte Google. C’est un raccourci que je trouve regrettable car la surface d’attaque est assez large en cas de compromission.

darkjack a dit:

Quelqu’un a posé la question à Chat GPT sur la qualité de la gestion de la sécurité de son service pour rire? Je n’ai pas de compte et pas envie d’en créer, je l’avoue.

En version GPT3/4 seules il dira rien d’intéressant, surtout que le modèle est figé à fin 2021.

En version GPT4 + Browse mode, il est capable de produire un rapport sur la gestion de la sécurité du service car il va se baser sur les sources externes.

J’ai demandé un rapport sur la sécurité d’OpenAI sur 2023, il m’a listé tous les incidents connus qui ont été publiés. Puis j’ai demandé de commenter la qualité de la sécurité de l’entreprise en se basant sur ce rapport et l’outil est relativement équilibré. Après faut pas oublier qu’il est conçu pour être très politiquement correct et donc le texte produit ne cherchera pas à enfoncer le clou comme peut le faire un journaliste ou un commentateur.

The quality of security in any organization can be challenging to definitively assess based solely on public incident reports because many factors contribute to an organization’s overall security posture, including its internal processes, employee training, use of security tools, and how quickly and effectively it responds to discovered vulnerabilities and breaches.

That being said, based on the incidents reported for OpenAI in 2023, it appears there have been a few notable security issues. These incidents include a data breach due to a bug in an open-source library, a serious vulnerability related to a new feature, and compromised account credentials found on the dark web.

However, it’s important to note that in each of these cases, OpenAI has taken action to mitigate the impact of these security issues. For example, in the case of the data breach, they worked with the maintainers of the Redis data platform to patch the flaw. When a serious vulnerability was discovered, OpenAI was transparent about the issue. In the case of compromised account credentials, OpenAI has recommended best practices for password hygiene and the use of two-factor authentication to its users.

In addition, OpenAI has shown a commitment to maintaining the performance and reliability of their systems. They have been transparent about issues affecting their services, as shown by their public status updates, and have provided information about the resolution of these issues.

These factors suggest that while OpenAI has faced significant security challenges, the organization is proactive and transparent in addressing these issues, which are positive signs of a strong security culture. However, the occurrence of these incidents also indicates areas where improvements can be made.

Ultimately, while OpenAI has encountered some security issues, it has also demonstrated a commitment to resolving these incidents and taking steps to prevent future occurrences. This balance between the occurrence of incidents and the response to them is typical in the tech industry, particularly for companies dealing with complex AI systems and large user bases. Security is an ongoing process of risk management and continuous improvement, and it appears that OpenAI is actively engaged in this process.

It’s worth noting that security is a shared responsibility. While OpenAI can implement measures to secure its systems and data, users also need to practice good security hygiene, such as using strong, unique passwords and enabling two-factor authentication, to protect their individual accounts.

J’ai profité du fait que le 2FA soit désactiver pour lui notifier ce fait et pareil, la réponse est en mode pour et contre et très lissée (“oui c’est une mauvaise chose de l’avoir désactivé mais doit y avoir des raisons” en résumé), comme usuellement avec les LLM de ce type.