I'm fairly certain that unless the referer is the "new" page, it counts negatively toward the story's promotion.
Show HN: A Way To Hack HN's Karma
31–38 of 38 posts
Re: Show HN: A Way To Hack HN's Karma
#32I'm fairly certain that unless the referer is the "new" page, it counts negatively toward the story's promotion.
The #1 post on HN is exploiting this and it's working just fine.
Re: Show HN: A Way To Hack HN's Karma
#33Earlier quoted context omitted.
CSRF couldn't stop this particular attack, since it's not actually cross-site. You need to guard against both.
I think you misunderstand what CSRF protection does. It doesn't have anything to do with same-origin security, but rather preventing request forgery attacks in general. If a CSRF token was present on requests and was tied to a user's session (as is standard), then that would absolutely defend against this attack.
Wonder if you could get around that by submitting a javascript: link.
Re: Show HN: A Way To Hack HN's Karma
#34Earlier quoted context omitted.
I think you misunderstand what CSRF protection does. It doesn't have anything to do with same-origin security, but rather preventing request forgery attacks in general. If a CSRF token was present on requests and was tied to a user's session (as is standard), then that would absolutely defend against this attack.
Wonder if you could get around that by submitting a javascript: link.
As far as I can tell, only http(s) links are accepted by the submission form.
Re: Show HN: A Way To Hack HN's Karma
#35I had always assumed this was impossible because my votes have an auth key attached. Does this mean that the auth key is not used and is just there to trick casual observers into thinking there is security? vote?for=3742852&dir=up&by=citricsquid&auth=478876d54494692615d9f2ca184fa9fab2fb9ff7&whence=%69%74%65%6d%3f%69%64%3d%33%37%34%32%37%34%32
This is for the comment votes; it looks like the vote for articles doesn't have a token.
Re: Show HN: A Way To Hack HN's Karma
#36Earlier quoted context omitted.
Or we could just avoid doing this to each other. Security through obscurity?
Nope. Security through niceness and ethics. If everyone was in on it we would have a really great society.
I don't think anyone would contest that good behavior would be good for society. But, it's not a practical expectation, because the probability of everyone exhibiting good behavior is vanishingly small.
Re: Show HN: A Way To Hack HN's Karma
#37Earlier quoted context omitted.
Or we could just avoid doing this to each other. Security through obscurity?
Nope. Security through niceness and ethics. If everyone was in on it we would have a really great society.
That is exactly security through obscurity. If you're relying on people being nice enough to not exploit you (no matter how difficult it is), you have no security at all.
Let's say everyone on HN was nice enough to not use exploits. Might be possible. But then one person does a drive-by exploit, and BAM. Everyone but one person is nice enough to not exploit people.
Just because you wish people were nice doesn't make them nice.
Re: Show HN: A Way To Hack HN's Karma
#38Earlier quoted context omitted.
Nope. Security through niceness and ethics. If everyone was in on it we would have a really great society.
That is exactly security through obscurity. If you're relying on people being nice enough to not exploit you (no matter how difficult it is), you have no security at all. Let's say everyone on HN was nice enough to not use exploits. Might be possible. But then one person does a drive-by exploit, and BAM. Everyone but one person is nice enough to not exploit people. Just because you wish people were nice doesn't make…
No, it's just lack of security. There's no obscurity involved at all.
(And, if there was any doubt, we should of course not count on people being nice on the internet.)