Hacker News new | ask | show | jobs
by oriettaxx 1175 days ago
It's pretty bad to ask people to enter e private secret key in a web site (any, I mean)
4 comments
thangngoc89 1175 days ago
They provided an option to build it locally and run it yourself. But yeah, I wish there is a common proxy protocol that would allow website accessing private resources without exposing private keys
link
titaniczero 1175 days ago
OpenAI should implement an oauth authorization server and allow developers to use "Login with OpenAI account" into their apps.
link
butterfly771 1174 days ago
I agree, this is the best solution, I'm sick of countless projects with key input fields where I have to go to Ctrl/CV every time.
link
blazespin 1163 days ago
Not to mention the ludicrously gaping security issue that this is. My guess is they want to push people to the plugins tho.
link
andag 1175 days ago
Maybe a small video demo would be an ok alternative?
link
Veen 1175 days ago
What alternative would you suggest for a free service that depends on OpenAI APIs? It's easy enough to generate an API key for this service and delete it afterwards.
link
gkbrk 1175 days ago
Why? OpenAI keys can be revoked at any time, and OpenAI allows you to set soft and hard limits for billing as well.

You can also generate multiple keys, so if one app misbehaves, you don't need to rotate all the keys, just the one that misbehaves.

This is assuming the API keys can only do generation. If it can access billing details or something it's very different of course.

link
balls187 1175 days ago
> Why?

Because it's bad practice to provide sensitive information to untrusted sources, and if you are an ethical developer, it's an anti-pattern to write software that encourages bad practices.

Your credit card company will reverse any authorized charges. Will you email me all your credit card info?

link
sebzim4500 1175 days ago
If I could generate a credit card number just to send you money then yeah sure.
link
oriettaxx 1174 days ago
> It's pretty bad to ask people to enter e private secret key in a web site (any, I mean)

I answer back to myself: I miss-understood since the idea of the developer is to run it locally http://localhost:3000 while I got scared from the DEMO

Congrats to the developer!

link