What kind of bullshit are people doing with GPT that this is even a concern?
this post was submitted on 03 Jul 2024
1 points (100.0% liked)
Furry Technologists
1312 readers
1 users here now
Science, Technology, and pawbs
founded 1 year ago
MODERATORS
Um whats the problwm here plain text on ur local computer? Isnt it only really a problem if u dont have disk encryption but u guess in that case u got far bigger issues.
Sadly, looks like they also didn’t store the files in an area accessible only to the user that created them. That seems like the most logical protection… I’m less worried about encryption if only my user id can access the files…
According to the post linked in the article, it's under ~/Library/Application Support.
The good news is that ~/Library isn't world-readable by default. The bad news is that it's still very easily readable by any process running under the user and by any other user with admin privileges or access to sudo.
I’m a little confused. If the conversations weren’t stored in plain text, wouldn’t the key have to be stored on your computer also? Isn’t that plain text with extra steps?
Depends on the system, but normally, the OS provides a way to encrypt a file using the user credentials. It's completely seamless while the user is logged in and using the computer. It's true that any program running with the user privileges and within its session can open the file, but once the user logs out it's unreadable.
With MacOS, specifically, it's stupidly easy and unintrusive to enable disk encryption. Outside of that, programs can save key-value pairs to Keychain (a credential store) and use that to store a randomly-generated encryption key.
It's true that any program running with the user privileges and within its session can open the file, but once the user logs out it's unreadable.
If the data was saved to the login Keychain, it should only be accessible while that specific user is logged in. The existence of vulnerabilities notwithstanding, it should actually be reasonably secure as long as System Integrity Protection is enabled and the program in question isn't running. SIP stops users (including root) from messing with system files or processes, and the Keychain requires a user password prompt to give programs access to entries created by other programs.
Now, considering all the above... it would have taken a day at most to figure out how to encrypt the data before it gets written to the file so it's not just sitting completely out in the open.
“We’re committed to providing a helpful user experience while maintaining our high security standards as our technology evolves.”
Ah, the most high security there is, plain text files.