News for hackers. Stuff that matters.

A comment on Faking votes on Hacker News. Parent comment

Re:Faking votes on Hacker News by tlrobinson on Monday March 16, 2009 @09:19PM (#519157)
Yes, I think it's considered CSRF, but indeed it's not as bad as it could have been, since it still requires you know the username of the logged in user.

It's also nowhere near as bad as the state of the Twitter API and apps, which require a username and password. People don't think twice about providing unlimited access to their Twitter account to random websites. Hopefully the OAuth API will fix that.

@pg: I think one solution would be to reject any vote requests with a Referrer header other than news.ycombinator.com

[ Parent | on HN ]
Re:Faking votes on Hacker News by tptacek on Monday March 16, 2009 @09:28PM (#519167)
Referer is totally insecure.

If all it is is votes, I say the right solution is "let it go".

[ Parent | on HN ]
Re:Faking votes on Hacker News by tlrobinson on Monday March 16, 2009 @09:39PM (#519189)
AFAIK, checking the Referer header actually works for preventing CSRF because you can't modify it for the types of requests that work cross domain, i.e. loading <img>, <script>, etc tags, or posting forms.
[ Parent | on HN ]
Re:Faking votes on Hacker News by tptacek on Monday March 16, 2009 @10:29PM (#519268)
Your assumption here isn't crazy, but it depends on the browser, and you shouldn't rely on it.
[ Parent | on HN ]