Hacker News Reader

Comment by x______________ | Hacker News Reader

Is "paste your OpenAI API key" the new form of "paste your credit card number with exp/code" for example, to check if its been compromised?

View on HN

For those who do not want to paste OpenAIkeys to other peoples web pages, there are local solutions.

For example, these audiobook generators runs fully offline. https://github.com/Finrandojin/alexandria-audiobook https://github.com/senigami/audiobook-studio.pinokio https://github.com/topics/audiobook-generator

You don't even need that. Just paste your pdf in codex or the gpt work app and say make me an audio book from this with such and such kind of voice.

> For those who do not want to paste OpenAIkeys to other peoples web pages

That should be everybody!

There are standard practices for delegating responsibility, never ever be pasting API keys into websites.

“Never ever” is crazy talk. Just put a couple of dollars in a prepaid account and assume it may all get used up. “Standard practices” won’t get you far in life.

I consider "Create a throwaway" to be in line with the guideline posted above. It does violate it literally but not in spirit - the guideline is not to use an API key with the ability to draw unlimited or a very large amount of funds.

Sure, but the comment I was replying to said “Everybody” and “never ever”.

Why? It's easy and predictable. Generate a key with a spend cap plus short expiry and you're set. I much prefer that to having to fork over my email with an OAuth flow.

You can generate a specific API key, and make sure to monitor it by setting a budget limit to it. They should explain this to people in their form to avoid people pasting their main key.

There was a guy who made a "has your SSH key been compromised? Paste your private key here" website as a joke, which lasted about a week until his low budget host killed it.

https://www.reddit.com/media?url=https%3A%2F%2Fi.redd.it%2Fx...

The original "Have I Been Pwned" ploy

Send me your data and I will check and see if anyone else has it

Now I have your data but that doesn't count

This shouldldve been a Plugin or Sign in with ChatGPT thing!

That doesn’t exist yet

They do offer an OAuth method.

Reply on news.ycombinator.com