On: Rabbit R1s break after elevenlabs key revoked

[jsheard]

Apparently their TTS service is already back online, but more interesting is the original post about why the keys were revoked

https://rabbitu.de/articles/security-disclosure-1

tl;dr they had hardcoded their Elevenlabs admin keys into their client, which allowed anyone to access the entire history of TTS responses for every Rabbit R1 user

[Retr0id → jsheard]

They didn't hardcode it into the client (source: I have personally RE'd their client code[0]), they hardcoded it into their server-side code, which certain security researchers claim[1] to have (had) access to.

[0] https://gist.github.com/DavidBuchanan314/aafce6ba7fc49b19206...

[1] https://rabbitu.de/articles/security-disclosure-1

[pram → jsheard]

"rabbit inc has known that we have had their elevenlabs (tts) api key for a month, but they have taken no action to rotate the api keys."

oof

[Fabricio20 → jsheard]

Oh this is bad. Real bad.

[wepple → Fabricio20]

Is it? Did anyone take that product seriously?

[bayindirh → wepple]

Data breaches and leaks involving personal data is always bad.

[Retr0id → wepple]

Supposedly, ~130K customers did

[dghlsakjg → Retr0id]

Who knew there were that many people doing tech reviews on YT?

[RIMR → Fabricio20]

For who? The grifters who are about to get sued into bankruptcy, or the hipsters who bought into the snake oil and are now out $199?

I would rate this as a "well, anyway...".

[lawlessone → jsheard]

> which allowed anyone to access the entire history of TTS responses

A lot of people are going to get scammed... again.

[jamesy0ung → jsheard]

Was the key also able to be used to generate text to speech?