api security

Bilingual

I think I was part of a model distillation attack
22 days ago
- The author received emails from OpenAI about inconsistent API usage and a 'Prohibited Biological Use' policy violation.
- Upon investigation, they found 114 unauthorized interactions with gpt-5.5 using a compromised legacy API key from 2023, possibly from bettergpt.chat.
- The attackers used the key for various tasks including a video QA benchmark, coding agents, and exporting insulin molecule chains, which triggered the policy violation.
- The attack involved a repo named 'ga-synthesis' where agents ran in environments like PyMOL, interacting with GUI apps via virtual desktop.
more...
Why We Don't Trust the Database with Authentication
a month ago
- Do not treat the database as the ultimate source of truth for API authentication, as it creates a dangerous vulnerability that can lead to full-system breaches.
- SQL injection can bypass API security by allowing attackers to copy and replace API key hashes, granting unauthorized access across tenants.
- Use cryptographic binding with a server-side pepper to sign API keys, tying them to structural context like key ID, rotation version, and organization ID to prevent hash swapping attacks.
- Implement rollback resistance by including a rotation version in the hash and using database triggers to enforce a one-way ratchet on version increments.
more...
How to Generate an API Key
24 days ago
- Use cryptographically secure random number generator (CSPRNG) for 128 bits of randomness.
- Add human-readable prefix indicating type and environment (e.g., sk_live_).
- Store only the SHA-256 hash; never store plaintext keys; show key only once.
- Verify keys via four-step process: format validation, hashing, database lookup, scope check.
more...

api security

I think I was part of a model distillation attack

Why We Don't Trust the Database with Authentication

How to Generate an API Key