Thread

1. postalcoder · 1790679044 · focus · HN ↗

   My least favorite trend I’ve noticed with so many AI chat services is they seem to equate a UUID in the url with privacy.

   Perplexity does this. Visiting a past perplexity search url exposes your full conversation.

   1. albert_e · 1790680002 · focus · HN ↗

      Security by obscurity -- such an age old anti-pattern!

      I believe many AI tools like Gemini generate publicly accessible URLs when we click "Share" on any chat conversation -- and expect users to then own the lifecycle of that link

      Depending on how the link gets handled -- by the browser, device OS, any hooks/plugins/extensions, aggressive telemetry, social media url previews, preload/prefetch, wrapping and url shortening, etc as it reaches the intended user -- there are countless ways in which the URL can be indexed and scraped

      There was a issue not long ago when Claude artifacts were indexed en-masse by Google and other search engines

      This is shockingly lax approach to data security and privacy by design

      1. kevindamm · 1790683979 · focus · HN ↗

         The same assumptions are true about giving any human that shareable link. They could pass it on to anyone, screenshot it, paste it into their own session. This has been true since before "share with link" permissions on Docs and elsewhere.

         If you click "provide a shareable link" you should decide (and behave) as though that made it public.

         I'm not saying it's good privacy posture on the side of the companies, but how else do you think that would work if there isn't any authentication step for the person viewing it? Even with authentication, "three may keep a secret, if two of them are dead."

         1. [deleted] · 1790693855 · focus · HN ↗

            [deleted]

Unofficial Hacker News client; not affiliated with Y Combinator.