News for hackers. Stuff that matters.

A comment on Show HN: Beak.js – Custom conversational assistants for your React app. Parent comment

Re:Show HN: Beak.js – Custom conversational assistants for y... by KMnO4 on Thursday November 16, 2023 @10:54AM (#38291074)
You’d be surprised… I ran a MITM proxy on my phone’s network and then downloaded ~30 of those scam apps which just wrap ChatGPT (you know, with names like “Best GPT AI chat 4”).

I found about a third were connecting to OpenAI directly, exposing their full API key in the headers of every request.

[ Parent | on HN ]
Re:Show HN: Beak.js – Custom conversational assistants for y... by msoad on Thursday November 16, 2023 @11:42AM (#38291770)
Amazing! Steal their keys and stop their $29.99/mo subscription after one month. Profit!

Even if they don’t expose the key it’s likely they are proxying the API with their own “security” which should not be too hard to steal the lang lasting token

[ Parent | on HN ]
Re:Show HN: Beak.js – Custom conversational assistants for y... by giovapanasiti on Thursday November 16, 2023 @11:25AM (#38291532)
LMAO. They kinda deserved you used those keys for your own interests.
[ Parent | on HN ]
Re:Show HN: Beak.js – Custom conversational assistants for y... by riverdweller on Thursday November 16, 2023 @03:50PM (#38295281)
Wow - just tried this and struck gold on the very first amateurish-looking GPT-wrapper iOS app I tested.
[ Parent | on HN ]