"multiple providers disclose sensitive conversation-derived artifacts — including titles, prompts, and screenshots — to third parties, often alongside persistent user identifiers that enable user attribution. We also find that some providers publicly expose conversation permalinks without access controls, allowing trackers to read the entire conversation."

Not good at all.

▲

postalcoder 3 hours ago | parent | next [-]

My least favorite trend I’ve noticed with so many AI chat services is they seem to equate a UUID in the url with privacy.

Perplexity does this. Visiting a past perplexity search url exposes your full conversation.

▲

albert_e 3 hours ago | parent | next [-]

Security by obscurity -- such an age old anti-pattern!

I believe many AI tools like Gemini generate publicly accessible URLs when we click "Share" on any chat conversation -- and expect users to then own the lifecycle of that link

Depending on how the link gets handled -- by the browser, device OS, any hooks/plugins/extensions, aggressive telemetry, social media url previews, preload/prefetch, wrapping and url shortening, etc as it reaches the intended user -- there are countless ways in which the URL can be indexed and scraped

There was a issue not long ago when Claude artifacts were indexed en-masse by Google and other search engines

This is shockingly lax approach to data security and privacy by design

	▲	kevindamm 2 hours ago \| parent \| next [-]
		The same assumptions are true about giving any human that shareable link. They could pass it on to anyone, screenshot it, paste it into their own session. This has been true since before "share with link" permissions on Docs and elsewhere. If you click "provide a shareable link" you should decide (and behave) as though that made it public. I'm not saying it's good privacy posture on the side of the companies, but how else do you think that would work if there isn't any authentication step for the person viewing it? Even with authentication, "three may keep a secret, if two of them are dead."
	▲	postalcoder 3 hours ago \| parent \| prev [-]
		Chat UIs are a minefield of “if you accidentally click this your data will be shared or trained without you realizing it!”

▲

someonebaggy 33 minutes ago | parent | prev | next [-]

Isn't that equivalent to a password? Knowing my password exposes my full data.

▲

msdz 3 hours ago | parent | prev [-]

Genuinely asking: If you don’t share the UUID-based URL yourself, what makes it not privacy-friendly?

It’s not like someone’s gonna guess that URL… right?

▲

postalcoder 3 hours ago | parent [-]

Yes, technically, guessing a url is impossible. But browser histories are stored in cleartext and trivially accessible to sketchy actors.

I also accidentally paste random stuff into input boxes all the time.

▲

msdz 2 hours ago | parent [-]

Good points, thanks.

Although I think at the point of some on-device program reading your browser history against your will, you’re gonna have bigger problems.

▲

kjs3 2 hours ago | parent [-]

You already have bigger problems then. Most people have given any number of plugins, etc., access to peek at browser history, clipboards, etc and didn't realize it. Run an ad blocker? VPN? Check out the permissions those sorts of things have on your device.

	▲	lukan 19 minutes ago \| parent [-]
		I want to get rid of whatsapp. Well, since years, but now the need increased. On android it is possible to give permissions "once" "while using the app" "always". But whatsapp now only accepts the full camera access. If you set "ask every time" to indeed only make a picture once and then no camera access anymore, it refuses and sends you to the permission dialoge.

▲

Aboutplants 3 hours ago | parent | prev | next [-]

“Screenshots”

The amount of sensitive information that accidentally gets left on screenshots is pretty large. This is a pretty massive security issue

▲

baggachipz an hour ago | parent | prev [-]

I'm shocked... SHOCKED! that these companies would sell this data to advertisers and violate the privacy of their users. Who could have seen this coming??

	▲	davsti4 31 minutes ago \| parent [-]
		No way will your future spouse be an AI entomed robot, with a percentage of your salary endowed to the corporate owner of the hardware.