Skip to content

NordTech: Berlin AppSec Meetup recap

This Autumn, our meetup with the Berlin Application Security community offered a glimpse into some cutting-edge topics in the field. AppSec is increasingly crucial for defending applications from the ever-present threat of malware and hacking attacks.  

Here’s a brief summary of the Nord Security talks. You’ll find links to the full videos as well.

Who downloads your NPM package? Research about NPM public registry bots and scrapers

from Rokas Tiškus

Rokas investigates suspicious bots that scrape packages on Node Package Manager (NPM), the world’s largest software registry. Developers can publish and share JavaScript software using NPM, but what could be driving bots to download this useful information…? Watch on to uncover the methods, patterns, and potential motives behind this dubious activity.

Watch Rokas’s talk on NPM bots

The state of MQTT: IoT’s favored messaging protocol

from Kasparas Bražėnas

Kasparas assesses the state of MQTT, “The Standard for IoT Messaging”. Citing security concerns raised as far back as 2016, he weighs up the protocol in its current form to see if improvements have been made. Tune in for a look at the global MQTT server landscape and persistent risks. Also, some essential tips for securing your ownMQTT environment.

Watch Kasparas’s talk on the state of MQTT

photos from the meetup

NordTech AppSec meetup

Don’t miss the next Nord Security meetup!

Follow us for all future tech events in Berlin and Vilnius.

Interested in creating a safer cyber future with us? Explore our open roles.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How to find saved passwords on Mac

One hundred — this is approximately the number of passwords an average user may need to manage across various accounts and platforms these days. 

This fact alone explains why most of us don’t even try to remember our passwords but, instead, choose to save and store them on our devices (or web browsers). It’s just so easy and convenient.

But what if, for some reason, we need to retrieve our stored passwords? Is it complicated? Let’s see what the process looks like when using a Mac device.

How to view saved passwords in Mac system settings

To see all the passwords you have stored on your Mac device, follow these steps:

  1. Click on the Apple menu button and select “System settings.”

  2. Find the “Passwords” section on the list of settings and click on it.

  3. Enter your user account password or use Touch ID to verify your identity.

  4. Go through the list of passwords to find the one you’re looking for.

To delete a password, you just need to click on it and select “Delete password.” However, if you want to update your password, click “Edit,” enter the new password, and click “Save.”

How to view saved passwords in Safari

If you want to access the passwords you store in the Safari browser, simply follow these steps:

  1. Open the Safari browser and click on “Preferences.”

  2. Choose the “Passwords” option located in the top tab.

  3. Verify your identity by entering your Mac password or using Touch ID.

  4. Choose a website from the list to show its stored password.

How to view saved passwords in Chrome

As a Chrome user, you have access to your saved passwords by navigating to the Chrome browser settings. Here’s what the process looks like:

  1. Open Google Chrome and click on the three-dot icon in the top right corner.

  2. Go to the “Settings” section and select “Passwords” under “Auto-fill.” Here you will find a complete list of the credentials stored in your Chrome browser.

  3. To access any of your stored passwords, simply click on the eye icon next to the one you want to check.

  4. Enter your password so that Google Chrome can confirm your identity and show you what the password is.

How to view saved passwords in Firefox

As in the case of Safari and Chrome, the process for locating your password in Mozilla Firefox involves a few straightforward steps:

  1. First, open the Firefox browser, click the “Menu” button, and select “Preferences.”

  2. Choose “Privacy & security” from the left panel.

  3. Navigate to “Logins & passwords” and select “Saved logins.”

  4. Click on the “Show passwords” button.

Why storing passwords on a device (and in browsers) is still problematic

Based on what we discussed, we wouldn’t characterize the process of locating your stored password on a Mac device (and in various browsers) as overly complex. Instead, it appears to be somewhat tedious and unnecessarily time-consuming.

Consider this: When you store some of your passwords on one device, some on another, and some in your browser (and probably a few in a notebook), not only do you introduce unnecessary complexity to accessing those passwords, but you also compromise their security. How so? Well, storing sensitive information in multiple locations increases the risk of unauthorized access and potential breaches.

What is the alternative? Using a password manager.

Sync your passwords and passkeys across all devices with NordPass

The optimal method for securely storing all your passwords in one convenient location is using NordPass, an advanced yet easy-to-use password manager that allows you to store, manage, and share passwords, credit card information, and personal data.

With its help, you can quickly autofill passwords and generate new ones as well as organize and categorize your credentials to your liking so that you can always access them easily and securely across all your devices.

Plus, as a modern platform that always keeps up with the times, NordPass facilitates passkey management, making it easy for you to enhance your cybersecurity and privacy.

So if you want to stop searching for guides on how to find your passwords on Mac, just use NordPass.

 

Frequently asked questions

How do you sync passwords between iPhone and Mac?

To sync passwords between your iPhone and Mac, you need to enable iCloud Keychain on both devices by accessing the iCloud settings. You need to confirm that both devices are using the same Apple ID, ensure they are connected to the internet, and keep the software updated. iCloud Keychain will then automatically synchronize your passwords across your devices.

How do you transfer passwords to a new Mac?

To transfer passwords to a new Mac, you need to make sure iCloud Keychain is enabled on the old Mac. Set up the new Mac using the same Apple ID and enable iCloud Keychain during the setup process. Your passwords should automatically sync to the new Mac, making them accessible for you on both devices.

How do you delete saved passwords on Mac?

First, locate the password you want to delete by following the process described above. Then, right-click on the password and select “Delete” from the context menu. Finally, confirm the deletion when prompted.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How to reset your Nintendo password

Picture this: your evening is free, and you’re ready for some gaming to relax and unwind. But you can’t remember your Nintendo password. Just like that, your perfect gaming moment is spoiled. It’s a common frustration many gamers face.

However, there’s no need to worry. Resetting your Nintendo account password is straightforward and quick. In just a few steps, you’ll be back to your gaming world. Let’s dive into how you can regain access to your Nintendo account without any hassle.

Nintendo password reset guide​​

Let’s tackle the situation we’ve just described: you’ve forgotten your Nintendo password. The solution? A password reset. This guide will lead you through each step to creating your new password. Here’s how it’s done.

  1. Go to the Nintendo homepage

  2. In the upper right-hand corner of the screen select “Log in/Sign up.”

  3. Select “Log in.”

  4. In the login screen, click “Forgot your password?”

  5. Now enter your email address and click “Submit.”

  6. You’ll receive a password reset link in your inbox. Click the link.

  7. Before you can create a new password you will need to enter the birthdate or nickname associated with your Nintendo account.

  8. Now enter your new password and confirm it by reentering it once more.

  9. Click “Submit.”

That’s it! You’re all done and once again have access to your Nintendo account.

How to change your Nintendo password

Now, let’s consider a different situation. Perhaps you remember your Nintendo password but want to change it, maybe as a proactive security measure. Here’s how you can change your Nintendo password in just a few steps.

  1. Go to the Nintendo homepage.

  2. In the upper right-hand corner of the screen select “Log in/Sign up.”

  3. Select “Log in.”

  4. Once you’ve accessed your Nintendo account, select “Sign-in and security settings.”

  5. Under the “Password” section, select “Edit.”

  6. You may be prompted to confirm your identity by re-entering your password, re-authenticating with your passkey, and/or by verifying your email address.

  7. Now enter your new password and reenter it to confirm it.

  8. Click “Submit” to finalize the changes.

That’s it, you’re all done!

Set up a passkey for your Nintendo account

Passkeys are a new and more secure way for accessing apps and websites, including your Nintendo account. Moving away from the traditional username and password setup, passkeys enable authentication and access via biometrics like face scans, fingerprints, or screen lock PINs – similar to unlocking a personal device. The advantage of passkeys is in their simplicity: there’s nothing to remember, reducing the risk of forgotten login details.

If you’re interested in using a passkey to secure your Nintendo account, setting it up is simple. Let’s go through the process step-by-step.

  1. Go to the Nintendo homepage.

  2. In the upper right-hand corner of the screen select “Log in/Sign up.”

  3. Select “Log in.”

  4. Once you’ve accessed your Nintendo account, select “Sign-in and security settings.”

  5. Now select “Passkeys” and click “Edit”

  6. You may be prompted to confirm your identity by re-entering your password, or by verifying your email address.

  7. Now select “Register a new passkey.”

  8. When prompted, enter your Nintendo account password and select “OK.”

  9. Select “Register.”

  10. Follow the instructions on the screen to use your device to register the passkey.

  11. That’s it. Now you can start using that passkey when signing in to your Nintendo account.

Enhancing online security with NordPass: Password and passkey management

Every online account, no matter how insignificant it may seem, holds sensitive information. Consider your Nintendo account: it contains personal details like your date of birth, legal name, location, email, and payment information. In the wrong hands, such data could wreak havoc on your personal life. This is where a robust password manager like NordPass becomes invaluable.

NordPass offers advanced features such as password generation, two-factor authentication, and Password Health to ensure the safety and security of your passwords and — by extension — online accounts. More than just a password manager, NordPass allows for the secure storage of passkeys, payment details, personal information, secure notes, and files.

For anyone seeking to streamline password management and level up their online security, NordPass is an essential tool. It not only secures your digital life but also makes it more efficient and manageable.

FAQ

What are the requirements for my Nintendo password?

The Nintendo password requirements are as follows:

  • The password must be 8 to 20 characters long.

  • The password must contain a combination of at least two of the following categories: uppercase or lowercase letters, numbers, and punctuation.

  • The password cannot have the same letter or character more than twice in a row.

Is it necessary to change my Nintendo password regularly?

Opinions vary on the frequency of changing passwords. However, regularly updating your Nintendo password is a good practice to maintain its strength and security and generally can form great security habits.

Can I reset my Nintendo password without access to my email?

If you’ve lost access to the email associated with your Nintendo account, the password reset process becomes more complex. In such cases, you should reach out to Nintendo’s support team for assistance.

What should I do if I receive a suspicious activity alert?

If you receive an alert about suspicious activity in your Nintendo account, immediately change your password and activate additional security measures. Vigilantly monitor your account and report any further suspicious activities directly to Nintendo.

How does two-step verification enhance account security?

Two-step verification, also known as two-factor authentication (2FA), can significantly enhance account security by adding an extra layer of protection beyond the traditional username and password.

This method requires users to provide two different types of information to access their accounts. The first factor is defined by something they know, like a password or PIN, and the second is something they have, such as a smartphone app generating a code or a physical token.

The dual-layer approach makes it much harder for unauthorized individuals to gain access, as compromising two authentication factors is significantly more challenging than just one. Even if a hacker obtains a user’s password, they still need the second factor to break into the account.

Here’s how you can set up two-step verification on your Nintendo account.

  1. Go to the Nintendo homepage.

  2. In the upper right-hand corner of the screen select “Log in/Sign up.”

  3. Select “Log in.”

  4. Once you’ve accessed your Nintendo account, select “Sign-in and security settings.”

  5. Now select “2-Step Verification,” and click “Edit.”

  6. Click “2-Step Verification setup.”

  7. You may be prompted to confirm your identity by re-entering your password, or by verifying your email address.

  8. Install the Google Authenticator app on your smart device.

  9. Use your smartphone app to scan the QR code displayed on your Nintendo account screen.

  10. A 6-digit verification code will appear on your smart device. Enter the verification code and then select Submit.

  11. A list of backup codes will appear. Click Copy to copy all the codes, and save them somewhere safe.

  12. Select “I have saved the backup codes,” then click “OK.”

That’s it, 2-step verification has been successfully set up for your Nintendo account

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Unmasking juice jacking: the hidden cyber threat lurking at public charging stations

Imagine this: you’re at an airport, and your phone’s battery is low. You spot a public charging kiosk—perfect, right? Well, not really. Welcome to the world of juice jacking. It’s like pickpocketing in the digital age, which happens while your phone is charging at public stations.

Juice jacking is mostly bad news for people who are always on the move, like travelers or those who do business on the go. Thus, this threat is on the radar of business cybersecurity risks.

While there isn’t much data on juice jacking or recorded events that serve as a precedent, this type of attack is a potential sleeper. Interestingly, earlier in 2023, the Federal Bureau of Investigation (FBI) and the Federal Communications Commission (FCC) raised awareness about juice jacking, implying that such cases have appeared.

In this article, we’re diving into the not-so-sweet details of juice jacking. We’ll uncover what it is, how the bad actors pull it off, and how you can dodge this sneaky cyber trick. Ready? Let’s jump right in.

What is juice jacking?

Juice jacking is like a stealthy attack on a phone, tablet, or laptop. It happens when someone plugs a device into a public charging station, and sneaky software slips into it. The goal is to steal information or infect your device with malware.

Which devices are the usual targets? Phones and tablets are the top picks, but really, it’s anything that charges up through a USB port. Think about your devices—smartphones, laptops, and even some e-readers. If it charges using USB, it could be at risk.

Where is this attack most likely to happen? Airports, malls, hotels, gyms, libraries—places with public charging spots that seem helpful when your battery’s running low. Attackers know that when a battery’s dying, people don’t think about security—they just want that charge. And that’s when the attackers make their move.

The mechanics of juice jacking

Imagine the charging cable as a two-way street. Typically, we think it’s just there to send power to your device, but it can also transfer data.

But here’s the sneaky part—criminals rig the public charging stations with a so-called “skimming device”—think of it like a hidden microphone, but for data. It’s tucked away inside the USB port, out of sight, waiting to snatch the data. When someone plugs in their device, this skimmer gets busy, extracting information from it or dropping off malware like an invisible spy.

How juice jacking works

Let’s dive deeper. Juice jacking is all about two things: stealing your business data and leaving behind nasty surprises in the form of malware.

Data theft

While a device is charging in a public station, the hidden skimming device gets to work. It discreetly sifts through the device, hunting for valuable information. We’re talking emails, contacts, and even confidential business files—the juicy details that you definitely don’t want in the wrong hands. So, while you’re waiting for a battery boost, someone could also be shopping online with your credit card.

Malware installation

Having a device connected and charging, the skimmer plays the role of a malicious invader, planting unwanted malware into your device.

Malware can have many harmful effects, like discreetly spying on your business activities, interfering with your device’s operation, or even locking you out of your own files. It’s like leaving a device with a bug that keeps causing trouble long after you’ve unplugged from the charging station.

Why endpoint security matters

Endpoint security is important in the grand scheme of a business’s digital safety net. It’s like having well-trained guards at every door and window of your office in the digital dimension.

  • A study by the Ponemon Institute reveals that 68% of organizations faced one or more endpoint attacks, leading to compromised data and/or IT infrastructure.

  • According to an IBM publication, 79% of business travelers unknowingly risk exposure to attacks by using public USB ports or charging stations.

  • A 2021 global Statista survey on endpoint security visibility revealed that 73% of participants considered isolating the endpoint from the network to be crucial for effectively responding to an endpoint attack. Meanwhile, 38% believed that locking user accounts and revoking credentials were vital actions in responding to such attacks.

In essence, endpoint security is not just a part of the defense; it’s a core element. It helps cement the walls of your business’s cyber fortress, ensuring that data remains protected and business operations flow smoothly without disruptions from sneaky, malicious invaders.

Preventing juice jacking

First, knowing if you’ve fallen victim to juice jacking is tricky. The device might act weird, like slower performance or unexpected pop-ups—signs that your device has been compromised if:

  • The device consumes more battery life than usual

  • It operates at a slower speed

  • Takes longer to load

  • Crashes frequently due to abnormal data usage

If you spot unfamiliar apps or your battery drains faster than usual, those could be red flags, too.

Best practices

Protecting your device starts with some simple habits. Keep a personal charger handy—your own charger is always the safest option. Public USB charging stations? Maybe skip those if you can. They’re like candy stores for cybercriminals.

To avoid being juice jacked, follow these tips for protecting your device:

  • Steer clear of public USB charging stations

  • Refuse requests for data transfer

  • Opt for two-factor authentication or biometric login options when possible

  • Bring along a personal portable charger or battery pack with you

  • Use electrical outlets with your personal charging cable and wall charger

Technological solutions

Technology can be your ally here. Consider using USB data blockers—they let you charge without the risk of data transfer. And keep your device’s software updated; it’s like giving the device some armor against malware.

Awareness and training

Knowledge is power. The more people know about these sneaky attacks, the better. Organizations should consider conducting training sessions—they’ll make their defense game stronger. And stay updated—new tricks pop up, and keeping in the loop helps stay one step ahead.

Juice jacking and corporate security

For businesses, juice jacking is a real headache. It’s not just about one device—it could jeopardize the whole company’s data. Especially for traveling employees, staying cautious is key. A simple charge at a public station could turn into a costly data disaster.

Further readings to grow your cyber awareness

FAQ

What types of business data are most vulnerable during juice jacking?

Any data stored on your device can be at risk. This includes emails, contacts, customer information, and sensitive business documents. Basically, anything you wouldn’t want to fall into the wrong hands.

How can businesses prevent their employees from becoming victims of juice jacking?

Education is key. Make sure employees are aware of the risks associated with using public USB charging stations. Encourage the use of personal chargers and provide USB data blockers as a protective measure.

Are certain types of public charging stations riskier than others?

It’s hard to pinpoint which public charging stations are riskier, as any station could be compromised. However, stations in less secure or highly populated areas may present a higher risk.

What immediate steps should be taken if an employee suspects their device has been juice jacked?

If there is suspicion, immediately stop using the device and disconnect it from networks to prevent potential data transmission. Conduct a thorough security scan, remove unfamiliar apps, and change passwords as a precautionary step.

How can a business assess the security of a public charging station?

It’s challenging to assess the security of a public charging station on the spot. Instead, focus on equipping employees with tools and knowledge to avoid risks, such as carrying personal chargers or using USB data blockers.

Should businesses avoid the use of public charging stations altogether?

While it’s not always feasible to avoid public charging stations entirely, minimizing their use and applying protective measures, like using USB data blockers, can help mitigate risks.

Can updated or newer devices still be susceptible to juice jacking?

Yes, even the latest devices can fall victim to juice jacking. Keeping devices updated and using security tools can help protect them, but awareness and caution are crucial.

Genetic data leak, 23andMe point to credential stuffing

Hackers are selling genetic data stolen from users of the company 23andMe. The company itself says they weren’t breached, although their users’ data was used by what seems to be a single threat actor stealing personal details and genetic data. This data was then published or advertised online. 23andMe suggested that the threat actor(s) gained unauthorized access with “recycled login credentials”, a technique known as credential stuffing.

The logic is simple: Keep trying stolen username/password combinations, and eventually, they’ll work on another site. An easy solution to credential stuffing attacks? You guessed it: Multi-factor authentication (MFA). While 23andMe has offered an MFA feature since 2019, it was not made mandatory for users. With genetic and personal data at stake and up to 7 million users affected by these recent breaches, it might be time for a change in policy.

The Bleach Breach: Clorox revenue and supply chain hit

Clorox, the household cleaning giant, predicts a more than 20% drop in quarterly sales due to a cyberattack (thought to be ransomware) that caused product shortages and operational disruptions. Manufacturing, often kept running by legacy systems and sprawling workforces, suffers more cyberattacks than any other industry.

The Clorox incident is being linked to the same group responsible for the MGM and Caesars Palace hacks, discussed in our previous episode, which occurred around the same time in August 2023. “Scattered Spider” is notorious for using social engineering methods to gain access to internal systems. The Clorox Company’s share price has dropped by over 7 percent in the last month.

Wearable AI: Trendy or just trending?

Tech companies are rushing to secure the lead in wearable AI products. Meta has collaborated with Ray-Ban on a pair of high-tech glasses, enabling wearers to live stream directly from the glasses to Facebook or Instagram and voice activate Meta AI, “an advanced conversational assistant”. Jony Ive, Apple’s legendary former design lead, and OpenAI are reportedly teaming up to design the “iPhone of AI”.

Rewind.ai unveiled a neck-worn pendant that records conversations to your smartphone and creates a searchable database of life moments. Humane, imagining “a world where you can take AI everywhere”, have developed a smart device that resembles a badge or lapel pin.

The common goal here seems to be for technology to rely less on screens, to fade from view, and become all but invisible.

Stay tuned for the next episode of Cyberview.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Is ChatGPT safe?

For many, artificial intelligence was a somewhat theoretical concept until OpenAI introduced ChatGPT. Released at the end of 2022, it needed only five days to surpass 1 million users. Within a year, over 180 million people around the globe now use this chatbot. For sure, plenty of people registered on openai.com simply out of curiosity. However, the number of ChatGPT daily users for private and work purposes is growing exponentially.

Usually, it’s the OpenAI tool answering our queries, but let’s do things differently today and actually ask ourselves two fundamental questions: “How does ChatGPT work?” and “Is ChatGPT safe to use?”

What is ChatGPT, and how does it work

ChatGPT, short for Chat Generative Pre-trained Transformer, is a chatbot that uses artificial intelligence to mimic human language and conversations. It’s a large language model that pulls data from large datasets. It uses deep-learning algorithms, including neural networks, to process the information and generate almost-human-like text answering users’ queries.

ChatGPT is not the first AI-based tool that made its way into our lives. However, there’s a significant difference between OpenAI’s child and Siri or Google Assistant: ChatGPT learns from us, humans. It may sometimes produce inaccurate or even biased information, but it gets smarter and more reliable with every prompt and piece of user feedback.

Now, let’s dive into the concerns related to ChatGPT security.

ChatGPT security concerns

We can put the safety concerns related to ChatGPT into a few different categories:

  • Data security risks

To talk with ChatGPT, a user must register on the creators’ website, chat.openai.com. The platform requires your name, email address, password, and phone number to create an account, and – if you’re going for the paid version – payment details. All the mentioned data will be available to and stored by OpenAI, possibly putting you at risk in case of a data breach.

OpenAI also collects chat history, which became available for other users during the ChartGPT 9-hour outage in March 2023. Later, OpenAI released a report stating that the bug in the open-source library also allowed unauthorized users to see the beginning of someone else’s conversations, account details, and payment information (including the four last digits of credit card numbers)! The company states: “The full credit card numbers were not exposed at any time,” but the leaked data may have put the chatbot’s users in danger of social engineering or phishing attacks. And there’s no guarantee that similar data breaches won’t happen again.

  • Misuse of ChatGPT

ChatGPT can produce many lines of code at a speed humans can only dream of. No wonder it became an everyday tool for many programmers, hackers included. The chatbot can generate code to create malware or detailed instructions on how to hack a computer, which, combined with dark web forums and programming skills, may be a powerful weapon in the hands of cybercriminals.

As another example of possible misuse, the tool created by OpenAI is also known for creating text in many different styles. If it can mimic an acclaimed writer, and it can easily generate a huge number of perfectly crafted phishing emails.

  • Scam ChatGPT applications

Before releasing an Android app at the end of July 2023, ChatGPT was only available on desktops and iPhones. However, apps masquerading as ChatGPT flooded the internet, spreading malware or making people pay for services OpenAI provides for free.

Since the roll-up of legitimate apps and the removal of scam ones, the risk connected with fake ChatGPT apps has decreased. Still, if you’re asking yourself, “Is ChatGPT safe to download?”, the answer is “Yes, but only from a reliable source.”

  • Spreading misinformation

ChatGPT is trained with vast amounts of data, including books, articles, and websites, and it reflects the opinions shared by the authors. It can generate text containing false or misleading information that may lead to prejudice and bias. In times of “fake news,” it’s vital to cross-check data. ChatGPT is no exception.

ChatGPT security measures

OpenAI seems to take ChatGPT security seriously. The company has implemented several measures to ensure the safety of chatbot users and their private information.

Access control: OpenAI limits access to its models and data to a select group within the organization to prevent data breach or misuse.

Encryption: Communication and data storage related to ChatGPT and other OpenAI models are encrypted to protect against unauthorized interception or access.

Monitoring and logging: OpenAI monitors ChatGPT usage and responds to any unusual or unauthorized activity.

Regular audits and assessments: The creators of ChatGPT conduct regular security audits and assessments to identify and address vulnerabilities, including internal and external reviews, to ensure a comprehensive evaluation.

Collaboration with security researchers: OpenAI also collaborates with the broader security research community, encouraging responsible disclosure of identified vulnerabilities.

User authentication: Users interacting with OpenAI’s most famous creation are required to authenticate their identities.

Compliance with regulations: OpenAI complies with relevant data protection and privacy regulations that ensure appropriate and secure data handling. Details and the company’s policies can be found on trust.openai.com.

Addressing bias: Bias in AI models can emerge from the data they are trained with and can reflect and perpetuate existing societal biases. OpenAI claims to train ChatGPT on diverse data sets that represent a wide range of perspectives and backgrounds. It also develops bias mitigation methods to identify and reduce biases in the chatbot’s answers.

How to use ChatGPT safely

ChatGPT’s security raises many questions and it certainly is not bulletproof. Check out our tips on how to stay protected while using OpenAI’s chatbot.

1. Avoid fake websites and apps

Always interact with ChatGPT via its website chat.openai.com, or its official mobile app. The fake applications may harvest your data, make you pay for functions that are supposed to be free, or even install malware on your device.

2. Secure your account with a strong password

Your account information and chat history are only as safe as your password. It should always contain more than eight characters, including upper- and lowercase characters and symbols. Use the online Password Generator to create complex and random login credentials and check how secure your current password is. Or, choose the easier way to safety: set up and manage login credentials in the NordPass password manager.

3. Don’t share personal information or content

Interactions with ChatGPT are not private. OpenAI can use your chat history for research and model improvement purposes which is why you should never share your personal, confidential, or sensitive information, such as passwords or financial details. Also, be cautious when discussing personal or sensitive topics, especially if they can lead to identifying you.

4. Cross-check the information and be aware of bias

ChatGPT reflects the opinions and biases of the data sets it’s been trained with. That’s why you should always cross-check the information the chatbot serves you with reliable sources and approach them with a healthy dose of skepticism.

5. Report issues

Provide feedback to OpenAI if you encounter any issues, biases, or inappropriate behavior with ChatGPT. To do that, log in to your account and use the “Help” button to start a conversation. If you don’t have an OpenAI account or can’t log in, go to help.openai.com and select the chat bubble icon in the bottom right.

FAQ

What is ChatGPT doing with my data?

OpenAI uses personal information to provide, maintain, improve, and analyze ChatGPT. The company also develops new programs and services based on user data and carries out business transfers. Note: According to its privacy policy, OpenAI may, in some instances, provide user data to third parties without further notice.

Does ChatGPT record data?

Yes, ChatGPT saves and stores user data, including:

  • Usage data (location, the time, and the chatbot version).

  • Log data (user’s IP address, the browser).

  • Device data (user’s type of device and operating system).

  • Content produced during the conversations with the chatbot.

Does ChatGPT sell your data?

OpenAI claims not to sell or share user data for marketing and advertising purposes. However, its privacy policy states that the company may share users’ private information with third-party vendors and service providers, which raises some concerns.

Is ChatGPT confidential?

No, ChatGPT is not confidential. The app logs users’ conversations and other personal data to train its model. OpenAI can also share users’ private information with third parties like vendors or legal authorities. The company claims to put a lot of effort into privacy policies, but there’s already been an incident when users’ data and conversation history were exposed.

Is ChatGPT safe to use at work?

The most considerable risk for enterprises is that people think ChatGPT is a tool to cut mundane tasks, something like a cutting-edge calculator. However, the information employees share with the free OpenAI chatbot can go into the cloud or be logged into its servers and revealed to different users during the conversation.

OpenAI offers an app for business, ChatGPT Enterprise, with dedicated privacy and security features. It doesn’t train on the company’s data, making it more secure for work.

Keep in mind that the business version of the chatbot doesn’t solve issues related to processing unreliable information or bridging the property rights of books, articles, and websites on which ChatGPT is being trained.

Is ChatGPT safe for kids?

ChatGPT is available for users over 13, and it’s unsafe for younger children to use it unsupervised. Despite the safety mitigations OpenAI implemented, there are many examples of the chatbot producing content not suitable for children.

Parents should also be wary of ChatGPT reproducing unreliable or biased information.

Is ChatGPT safe for students?

ChatGPT can be helpful for research but lacks critical thinking and analysis abilities. It can provide false information, so you should always cross-check it with reliable sources.

The OpenAI chatbot is being trained on books and articles whose ownership it doesn’t acknowledge, which can lead to copyright issues, plagiarism, and incorrect source quotations.

Should I use my real name on ChatGPT?

You should avoid sharing any private information while interacting with ChatGPT. Consider using a pseudonym or removing your name from the queries.

Why does ChatGPT need my phone number?

OpenAI needs your phone number for authentication purposes, to ensure you’re a real person, and to secure your account.

Remember, your private information, including the phone number, is unavailable to the chatbot itself. And you should never share this kind of info with it!

Can ChatGPT access any information from my computer?

ChatGPT is a text-based model that processes interactions on its servers. The model generates responses based on the input it receives, but it cannot access files on your device, or retrieve personal data from your computer.

There is some technical data that OpenAI automatically collects, like your log and usage data and device information. To find out more, check the company’s privacy policy.

How do I delete my chat history on ChatGPT?

To delete your chat history:

  1. Sign in to ChatGPT.

  2. Click your account icon on the bottom left corner of your screen (desktop) or in the menu bar (app).

  3. Choose “Settings.”

  4. Select “Data controls.”

  5. Click “Clear chat history” and then “Confirm.”

You can also remove a specific conversation by clicking its entry on the left hand-side and then choosing the trash can icon.

Can you delete your ChatGPT account?

You can submit a request to delete your account through privacy.openai.com or do it yourself.

To delete your ChatGPT account manually:

  1. Sign in to ChatGPT.

  2. Click your account icon on the bottom left corner of your screen (desktop) or in the menu bar (app).

  3. Choose “Settings.”

  4. Go to “Data controls.”

  5. Then, choose “Delete account” and “Confirm.”

Remember that after deleting the account, you won’t be able to create a new one using the same email address.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Need help? Our team is just a message away