21–30 of 38 posts
PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
Now that it's out there, I made a self up voting version: http://news.ycombinator.com/edit?id=3742902
I had always assumed this was impossible because my votes have an auth key attached. Does this mean that the auth key is not used and is just there to trick casual observers into thinking there is security? vote?for=3742852&dir=up&by=citricsquid&auth=478876d54494692615d9f2ca184fa9fab2fb9ff7&whence=%69%74%65%6d%3f%69%64%3d%33%37%34%32%37%34%32
PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
CSRF protection is the right way to solve this. Switching to POST doesn't provide any real protection; an attacker can simply put up a form that autosubmits to the endpoint with POST.
PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
Security through obscurity?
PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
Hacker News has grown dramatically. The "Hacker News effect" is now significant and often considered valuable. If there is an exploit that makes it possible, people will use it.
Earlier quoted context omitted.
CSRF protection is the right way to solve this. Switching to POST doesn't provide any real protection; an attacker can simply put up a form that autosubmits to the endpoint with POST.
CSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.
PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.
Or we could just avoid doing this to each other. Security through obscurity?
I saw this but don't really consider it much of a problem. It's the kind of thing that you can't really exploit. It'd be obvious if you really tried to use it for evil and then PG would kill your account.
Not necessarily. You could make the CSRF request on, for example, 80 percent of the views to make it look legit. You could even take a more sophisticated approach and start by automatically upvoting for 100 percent of logged in users just to get on the front page and dampening once your story rises in the rankings.