News for hackers. Stuff that matters.
Re:University Suspends Students for AI Tool It Gave Them $10... by dylan604 on Tuesday May 21, 2024 @12:12PM (#40430353)
> give them their canvas API tokens

in pretty much every single system's terms, providing someone else your tokens or other forms of sharing of credentials is expressly forbidden. this is why I am flabbergasted things like Plaid work. I will never provide a 3rd party my credentials to anything but damn sure not something like a bank or credit card.

Re:University Suspends Students for AI Tool It Gave Them $10... by javagram on Tuesday May 21, 2024 @12:44PM (#40430773)
There are many systems that allow generating a API token to be used with other apps. The article clearly indicates that this school learning system, “Canvas”, had such a functionality until it was removed during this saga, apparently by hiding it with CSS or something since there was an “inspect element” workaround to still access it.

Plaid uses OAuth for many of their connections and doesn’t violate ToS in that case. There usually are TOS related to not sharing your password and disclaiming liability if you do.

Re:University Suspends Students for AI Tool It Gave Them $10... by loeg on Tuesday May 21, 2024 @02:58PM (#40432403)
3rd party access is the entire point of API tokens. Use cases like this are why Canvas has them.