Hacker News

points by toomuchtodo 2 days ago | 0 comments

Always use a hidden email service, you cannot trust the LLM or inference provider to secure the email address in this context. If they don’t have the email address, they can’t leak it.

I never give a provider my actual email address, I recommend others do the same. Otherwise, it’s just a matter of time until it is leaked or otherwise part of a data breach.

[–] komali2 2 days ago

If you let the LLM see git commands, they have whatever email you use to sign commits.

[–] ceuk 2 days ago

I use a masked email for Git too. Always have. Last 5 years or so it's just been the GitHub provided mask e.g. <numeric-ID>+<username>@users.noreply.github.com

[–] soraminazuki 4 hours ago

That won't save you in this case because that email address still identifies you. It's an anti-spam measure, not a privacy measure.

[–] j45 2 days ago

Masked email or separate email is the way.

[–] toomuchtodo 2 days ago

I am a security person, I don’t let the LLM see anything except that which I wouldn’t mind printed on the front page of the New York Times. I treat my LLM context as I would a potentially malicious threat actor. Nothing valuable, sensitive, or personal goes into the context.

“lethal trifecta”

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

(a component of my cybersecurity work is red teaming inference, agents, and mcp interfaces)