Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

gdeglin.blogspot.com

Post reply on HN
Print view View original

1–10 of 13 posts

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#2

Post by gdeglin »

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#3

Post by JacobAldridge »

gdeglin wrote: post #2

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

I found it well written. Since I don't code the technical side was, eventually, lost on me but I think I still managed to understand the vulnerability, how you identified and tested it, and the solid job you did bringing it to their attention and being heard.

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#7

Post by gleb »

gdeglin wrote: post #2

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

It would be helpful to elaborate on:

  * what document.domain is
  * what hijacking user's session actually implies

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#8

Post by sprout »

gdeglin wrote: post #2

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

It was great to hear a story about responsible disclosure working perfectly. Usually all you hear about is when the shit hits the fan and the guilty company is left with their pants down after having months to pull them up.

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#9

Post by X-Istence »

gleb wrote: post #7
gdeglin wrote: post #2

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

It would be helpful to elaborate on: * what document.domain is * what hijacking user's session actually implies

I know what hijacking a user's session is, what is document.domain though?

Re: Careful when hosting 3rd party apps on subdomains, or how I hacked Facebook

#10

Post by zalew »

gleb wrote: post #7
gdeglin wrote: post #2

This is my first blog post about web security, and hopefully the first of many. I'd love to hear feedback and I'm happy to answer questions. One of the concerns I had with this post was that it is highly technical, but I feel the issue is extremely important since so many sites are vulnerable to these kinds of issues.

It would be helpful to elaborate on: * what document.domain is * what hijacking user's session actually implies

document.domain http://www.w3schools.com/jsref/prop_doc_domain.asp
Post reply on HN