Egor Homakov

Most-linked posts?

1. "Egor, stop hacking Github"
   4 people · 4 mentions · first linked 2012-03-04
2. Hacking Github with Webkit
   4 people · 4 mentions · first linked 2013-03-09
3. The No CAPTCHA problem
   3 people · 5 mentions · first linked 2014-12-04
4. OAuth1, OAuth2, OAuth..? (2013)
   3 people · 4 mentions · first linked 2013-03-01
5. Two severe "WontFix" vulnerabilities in Facebook Connect
   3 people · 3 mentions · first linked 2014-01-27
6. Using Content-Security-Policy for Evil
   2 people · 3 mentions · first linked 2014-01-13
7. Whitelist Your Routes, "match" is Evil
   2 people · 3 mentions · first linked 2012-04-24
8. ///host.com or Evolution of Open Redirect Vulnerability
   2 people · 3 mentions · first linked 2014-01-13
9. The Most Common OAuth2 Vulnerability
   2 people · 3 mentions · first linked 2012-07-03
10. Are you sure you're using JSONP properly?
    2 people · 3 mentions · first linked 2013-02-15

What Hacker News says?

1. homakov · 2014-02-08

   I found that quirk occasionally. http://homakov.blogspot.com/2014/01/evolution-of-open-redire...

   Comment linking /2014/01/evolution-of-open-redirect-vulnerability.html

   on “How I hacked Github again”
2. zhuzhuor · 2014-02-07

   Submitted How I hacked Github again as a story · 911 points

   HN discussion
3. homakov · 2014-12-04

   I wrote my thoughts on this protection http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...

   Comment linking /2014/12/the-no-captcha-problem.html

   on “Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA””
4. llambda · 2012-03-04

   Submitted "Egor, stop hacking Github" as a story · 446 points

   HN discussion
5. BenjaminCoe · 2012-03-04

   I think you're winning me over to Egor's actions being more irresponsible and misguided than malicious -- chalk it up to him being 18. I'm finding it pretty hard to stay mad at someone with this tattoo: http://homakov.blogspot.com/2011/07/octocat-tattoo.html

   Comment linking /2011/07/octocat-tattoo.html

   on “Hacked: commit to rails master on GitHub”
6. paulmillr · 2014-01-18

   Submitted Cookie Bomb or Let's Break the Internet as a story · 362 points

   HN discussion
7. angersock · 2012-03-04

   You've apparently also suspended his account...? ( http://homakov.blogspot.com/2012/03/im-disappoint-github.htm... ) If this is true, would you please consider unsuspending him? This doesn't seem like a good way to reward this sort of behavior (i.e., helping through hacking).

   Comment linking /2012/03/im-disappoint-github.html

   on “Hacked: commit to rails master on GitHub”
8. bluemoon · 2012-03-04

   Submitted How github was hacked as a story · 348 points

   HN discussion
9. shearn89 · 2012-03-04

   Also just noticed this at the bottom of his resume ( http://homakov.blogspot.com/p/service.html ): "<s>Discount for girls</s>"

   Comment linking /p/service.html

   on “Hacked: commit to rails master on GitHub”
10. VuongN · 2012-03-04

    Submitted Did GitHub Suspend Egor Homakov account? as a story · 329 points

    HN discussion
11. apl · 2012-03-04

    It's unfortunate that the guy stumbling upon this apparently noteworthy vulnerability happens to be so utterly immature . [EDIT: Unsurprisingly, the dude's 18. See http://homakov.blogspot.com/p/about-me.html for reference.]

    Comment linking /p/about-me.html

    on “Hacked: commit to rails master on GitHub”
12. homakov · 2013-03-09

    Submitted Hacking Github with Webkit as a story · 301 points

    HN discussion
13. zyfo · 2012-03-04

    Here's the guy's blog post about the hack: http://homakov.blogspot.com/2012/03/egor-stop-hacking-gh.htm... "Today I can pull/commit/push in any repository on github. Jack pot."

    Comment linking /2012/03/egor-stop-hacking-gh.html

    on “Hacked: commit to rails master on GitHub”
14. maccman · 2013-02-20

    Submitted How we hacked Facebook with OAuth2 and Chrome bugs as a story · 299 points

    HN discussion
15. tmcdonald · 2012-03-04

    I'm not sure all the things you list as being possible are true. - Every GitHub Repository could be access by anyone as if they had full administrator privileges. - This means that anyone could commit to master. - This means that anyone could reopen and close issues in issue tracker. - Even the *entire* history of a project could be wiped out. Gone forever. As I understand it from his explanation[1] he added his pub…

    Comment linking /2012/03/how-to.html

    on “GitHub and Rails: You have let us all down.”
16. homakov · 2014-12-17

    Submitted CSRF in Doorkeeper OAuth2 gem as a story · 249 points

    HN discussion
17. homakov · 2019-11-07

    Wow, why would the browser allow HEAD request in the first place w/o explicit confirmation from github server with CORS headers. This is very strange. It also reminded me of why "match" was removed in the first place - http://homakov.blogspot.com/2012/04/whitelist-your-routes-ma... - you could route any POST request via GET therefore bypassing CSRF checks still getting inside the controller.

    Comment linking /2012/04/whitelist-your-routes-match-is-evil.html

    on “Bypassing GitHub's OAuth Flow with a Head Request”
18. homakov · 2014-12-04

    Submitted The No CAPTCHA problem as a story · 215 points

    HN discussion
19. BenjaminCoe · 2012-03-04Recommends

    Alright, this did a pretty good job of winning me over to Egor: http://homakov.blogspot.com/2011/07/octocat-tattoo.html That tattoo is legit.

    Comment linking /2011/07/octocat-tattoo.html

    on “"Egor, stop hacking Github"”
20. homakov · 2014-01-27

    Submitted Two "WontFix" vulnerabilities in Facebook Connect as a story · 188 points

    HN discussion
21. lightedman · 2017-01-20

    As one of the project coders notes - "The normal token system revokes on password change" Very bad security practice. Token revocation is hard, folks. If you aren't making that token expire every session then you're doing it wrong. In fact, this was even discussed here on HN 1600+ days ago - http://homakov.blogspot.com/2012/07/saferweb-most-common-oau...

    Comment linking /2012/07/saferweb-most-common-oauth2.html

    on “How Discord Stores Billions of Messages Using Cassandra”
22. homakov · 2012-03-30

    Submitted #1 CSRF Is A Vulnerability In All Browsers as a story · 183 points

    HN discussion
23. homakov · 2024-03-20

    This led to a few serious bugs in Ruby-based apps. Always use \A\z https://homakov.blogspot.com/2012/05/saferweb-injects-in-var... https://sakurity.com/blog/2015/02/28/openuri.html https://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html

    Comment linking /2012/05/saferweb-injects-in-various-ruby.html

    on “Regex character "$" doesn't mean "end-of-string"”
24. brodd · 2013-12-14

    Submitted How to send DMs on Twitter without permission as a story · 167 points

    HN discussion
25. homakov · 2013-01-31

    http://homakov.blogspot.com/2013/01/rails-is-fragile-vulnera... This.

    Comment linking /2013/01/rails-is-fragile-vulnerabilities-will.html

    on “What The Rails Security Issue Means For Your Startup”
26. homakov · 2013-11-30

    Submitted RJS leaking vulnerability in multiple Rails applications as a story · 145 points

    HN discussion
27. danso · 2013-08-17

    This is a pretty vicious error but common one...it sounds like the analogue to Rails' mass-assignment default protections, which were exploited on Github by tampering with the params via inspector. Coincidentally, that bug was also exposed by a non-native English speaker who was dismissed for his inability to fluently express himself. http://homakov.blogspot.com/2012/03/how-to.html

    Comment linking /2012/03/how-to.html

    on “Facebook vulnerability 2013”
28. neverminder · 2015-01-23

    Submitted OAuth1, OAuth2, OAuth..? (2013) as a story · 139 points

    HN discussion
29. sillysaurus3 · 2015-01-26Recommends

    Homakov did an interesting writeup about a security architecture for an exchange: http://homakov.blogspot.com/2015/01/bitstamp-problem-and-war... You're probably looking for details beyond the security architecture, like how an exchange is implemented, but I figure I'd mention it.

    Comment linking /2015/01/bitstamp-problem-and-warm-wallets.html

    on “Coinbase Exchange”
30. dsr12 · 2014-12-07

    Submitted New Paypal gateway UI susceptible to spoofing as a story · 120 points

    HN discussion

Search all of HN for homakov.blogspot.com

Linked by the same people?

• DDaniel LeCheminantdanlec.com
• Eemptywheelemptywheel.net
• IIsaac Z. Schlueterblog.izs.me
• PPlataformatec Blogblog.plataformatec.com.br
• MMike Perhammikeperham.com
• MMoserwaremoserware.com
• GGlyph Lefkowitzglyph.twistedmatrix.com
• CCircleCIcircleci.com