The best way to not have your private information leaked by AI is to not use it.
Join me next week for more cybersecurity tips
This isn’t even regular Facebook casual abuse of user data.
This is just straight up slop coded failure to even consider security.
The source article does a much better job explaining. It doesn’t seem like the author of this article understood what they were describing.
Apparently, the problem is that all you need to know to access the shared data is the DNS hostname, and the DNS hostname is intentionally shared with third-party DNS resolvers and unintentionally published through services that collect unsecured DNS requests. It kind of makes sense that you would want to put the shares on different DNS domains because they’re different browser security origins and that makes it more difficult for cross site scripting, and then if the DNS domain already uniquely identifies the share, why put something more in the path? But putting a required unique value in the path would have prevented this because the path is sent encrypted to Facebook’s servers only.
I still don’t get it. Was there just a publicly available cache of “shares” for each user, with zero security behind it?
Edit: Oh wait, were the DNS resolvers themselves the “cache”, because the geniuses put the conversation id in the subdomain?
The Facebook LLM truthfully told the devs that host names aren’t private data.
At least not until you use it for private data.
