Top all-time · #7576
Bhavuk Jain
Personal blog · bhavukjain.com/blogsecurityprogramming
Bhavuk Jain's personal blog at bhavukjain.com covers security and programming. Since 2020, 10 different Hacker News readers have linked it 10 times, most often “Zero-day in Sign in with Apple”. It is still writing: the last post was on 2025-03-26, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN readers link this post on a JWT signature-check flaw in Apple's sign-in that earned a $100k bounty. Commenters use it as a reference point for bug bounty payouts and JWT and auth security debates.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Full stack developer interested in Web and Mobile Security.
Most-linked posts?
- Zero-day in Sign in with Apple8 people · 8 mentions · first linked 2020-05-30
What Hacker News says?
Exactly. The amount of effort put into finding multiple critical - high vulnerabilities of a $1TN+ company and the result is $51k + taxes to possibly share between 5 hackers for 4 qualifying bugs for that bounty sounds like Apple took them for a cheap ride through their campus. Compared to 1 hacker, 1 month, JWT signature check failure = 100k from Apple [0]: [0] https://bhavukjain.com/blog/2020/05/30/zeroday-signin-…
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “We Hacked Apple for 3 Months”Submitted Zero-day in Sign in with Apple as a story · 1076 points
HN discussionAs others have noted, this feels like an issue in the relying parties not relying on the `sub` field to validate the user. It feels the exact same as this issue here: https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... . In both, the details around the `sub` field, the field that should actually be used to identify the user, is poorly described. I would say that both of these feel a bit sensationalist, b…
Comment linking /blog/2020/05/30/zeroday-signin-with-apple
on “Google’s OAuth login doesn’t protect against purchasing a failed startup domain”Submitted Hijacking an UltraHuman Ring to Steal and Modify Health Data as a story · 2 points
HN discussionI don't think this issue is widespread enough and harmful enough to society to risk the privacy of all Apple users. Full stop. I haven't been particularly impressed with Apple's security record[1] lately, and I don't trust them to not mess this up. 1 - https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “Apple’s new abuse prevention system: an antritust/competition point of view”Submitted Zero-day in Sign in with Apple (2020) as a story · 1 points
HN discussionI don't know if the author is on HN (also not sure what difference this makes) but a payout of $100k made the news recently for https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... A few days later another researcher reported earning $75k for webcam access vulnerabilities: https://www.ryanpickren.com/webcam-hacking These payments are not uncommon.
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “Apple Security Research Device Program”Do you seriously expect them to pay $100k for a decently serious bug in only one of their products? In comparison, Apple paid 100k [0] for a full account takeover, using an bug so simple that it is unbelievable that it could have passed a code review and testing. [0]- https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “Stealing private documents through a bug in Google Docs”You mean, like this? https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... It's certainly possible to use JWT correctly, and with sufficient resources put towards auditing, most flaws will be caught. This doesn't make it a good design.
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “JavaScript Object Signing and Encryption is a bad standard (2017)”> I have never seen a major auth provider compromised Linkedin, https://en.wikipedia.org/wiki/2012_LinkedIn_hack Yahoo, https://en.wikipedia.org/wiki/Yahoo!_data_breaches Or if we don't limit it to just data breaches but include compromises that would have allowed a full account takeover of any account using this identity provider in a third party app: Apple, https://bhavukjain.com/blog/2020/05/30/zeroday-signin-wit…
Comment linking /blog/2020/05/30/zeroday-signin-with-apple/
on “Why outsource your auth system?”
