OWASP / OWASP/OpenCRE

Better inform users on chatbot privacy

Open
#375 2 comments 0 reactions 1 assignee View on GitHub

@northdpole is already working on this.

Since Sep 13, 2023.

Dominant language
Python
Stars
180
Forks
137
Avg merge
3d 23h
Merged PRs (30d)
21

Description

Better inform users on chatbot privacy -
while users log in, before they get shown the login, and when using it should be clear that:
-we only need them to login to maximize the number of queries per minute per unique user
-their account is not used to authenticate with the Large Language Model
-only their prompt is sent
-see the info on the chatbot page on this
-maybe we should link to the privacy policy of the PALM LLM
-we also need to update our privacy policy to reflect this info. The google SSO refers to it

It's best to first show a page when people arrive at /chatbot and have no session: describing the above, saying welcome to OpenCRE chat, and then a link to login, taking you to google SSO.

So basically a piece of text to show on that landing page, in the privacy policy and on the chatbot page.

Then somehow we need to deal with what google says in the SSO: "To continue, Google will share your name, email address, language preference, and profile picture with opencre.org" Either we need to change some settings, change that text, or refer to it in OUR text: despite that google sends us your name and mail address, we don't store it. Preferably we pick an SSO method that does not send it al all, or rather an alternative to google sso?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.