Top all-time · #6292
Salt Security Blog
Company blog · salt.security/blogsecurity
Salt Security Blog is the company blog at salt.security, writing about security. Since 2019, 13 different Hacker News readers have linked it 23 times, most often “Taking Over Booking.com by abusing social login”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN commenters link these posts on OAuth and social sign-in flaws, such as the Oh-Auth account takeover research, a ChatGPT extension OAuth flaw, and social login account takeover. The comments cite them as sources and do not judge the writing.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Salt Security is the only holistic AI security solution for the entire agentic AI lifecycle, from API discovery to posture management to threat protection.
Most-linked posts?
- Taking Over Booking.com by abusing social login4 people · 6 mentions · first linked 2023-03-02
- Oh-Auth – Abusing OAuth to take over millions of accounts4 people · 5 mentions · first linked 2023-10-25
- Reearchers Found Security Flaws in ChatGPT Ecosystem – A New Attack Vector2 people · 3 mentions · first linked 2024-03-13
What Hacker News says?
Large companies have fallen into this trap [1]. So you are right that aud addresses the problem, but it's widespread enough to question if it really affects just coding camp content farms. Hard to grok is probably possibly in some way a design flaw. [1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...
Comment linking /blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
on “Should I use JWTs for authentication tokens?”Submitted Reearchers Found Security Flaws in ChatGPT Ecosystem – A New Attack Vector as a story · 29 points
HN discussionI would add: * on the client side, store the token as a secure https only cookie, as local storage is accessible by any module of your app, see supply-chain attacks. * be extra careful with oAuth [1] * for APIs, be strict with CORS [2] [1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove... [2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
Comment linking /blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
on “Ask HN: Any comprehensive courses on Auth?”Submitted A New OAuth Vulnerability in a Framework Used in Hundreds of Websites as a story · 8 points
HN discussionAnd a link, if you want to read the official blog post: https://salt.security/blog/security-flaws-within-chatgpt-ext...
Comment linking /blog/security-flaws-within-chatgpt-extensions-allowed-access-to-accounts-on-third-party-websites-and-sensitive-data
on “ChatGPT Plugin Flaw – attackers could access private GitHub repos of others”Submitted Taking Over Booking.com by abusing social login as a story · 7 points
HN discussionThe link is not clickable: https://salt.security/blog/security-flaws-within-chatgpt-ext...
Comment linking /blog/security-flaws-within-chatgpt-extensions-allowed-access-to-accounts-on-third-party-websites-and-sensitive-data
on “And.. another OAuth vulnerability – now it's ChatGPT”Submitted Over 1M websites are at risk of sensitive information leakage as a story · 6 points
HN discussionActually, the CVE-2023-283131 vulnerability was published with the full details just two days ago. In April Expo published a short post but without too much technical information. You can find more details about CVE-2023-283131 in the link I shared here: https://salt.security/blog/a-new-oauth-vulnerability-that-ma... . Thank you for bringing up the distinction, and I agree that OpenID can help address some of the is…
Comment linking /blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
on “Ask HN: Why is OAuth still hard in 2023?”Submitted Traveling with OAuth – Account Takeover on Booking.com as a story · 2 points
HN discussionTLDR: A direct link to the interesting technical information: https://salt.security/blog/a-new-oauth-vulnerability-that-ma...
Comment linking /blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
on “Social sign-in is not secured: ATO on Booking.com, Codecademy and 100 more Apps”Submitted GraphQL Authorization Flaws in Financial Technology Platform as a story · 2 points
HN discussionhttps://salt.security/blog/traveling-with-oauth-account-take... Video: https://youtu.be/IK_AV1UFS-0
Comment linking /blog/traveling-with-oauth-account-takeover-on-booking-com
on “Researchers took over Booking.com accounts using a legitimate Facebook link”Submitted API Supply Chain Attacks – The Sky's the Limit as a story · 1 points
HN discussionhttps://salt.security/blog/traveling-with-oauth-account-take... https://www.csoonline.com/article/3689869/booking-com-accoun...
Comment linking /blog/traveling-with-oauth-account-takeover-on-booking-com
on “Beware of the risks of social sign-in – Hackers may target your accounts”Submitted Oh-Auth – Abusing OAuth to take over millions of accounts as a story · 1 points
HN discussionOriginal article: https://salt.security/blog/traveling-with-oauth-account-take...
Comment linking /blog/traveling-with-oauth-account-takeover-on-booking-com
on “Booking.com account takeover shows possible pitfalls in OAuth implementations”Submitted Security Vulnerabilities May Affect Lego Fans WordWide as a story · 1 points
HN discussionThis is the link to the research, you provided a link to Reddit: https://salt.security/blog/traveling-with-oauth-account-take...
Comment linking /blog/traveling-with-oauth-account-takeover-on-booking-com
on “Researchers took over Booking.com accounts using a legitimate Facebook link”Submitted OWASP Global AppSec Tel Aviv Recap as a story · 1 points
HN discussionThe original article [1] explains it much further: > As you read previously, according to the Facebook documentation, when Vidio.com receives the access token from the user, Vidio should verify that the access token was generated to its App ID (92356) by calling the https://graph.facebook.com/debug_token API. Confirming what vladvasiliu said. 1. https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...
Comment linking /blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
on “'Log in with ' Feature Allows Full Online Account Takeover for Millions”Submitted How to Control Top API Security Risks as a story · 1 points
HN discussionOriginal: https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove... Oh-Auth - Abusing OAuth to take over millions of accounts
Comment linking /blog/oh-auth-abusing-oauth-to-take-over-millions-of-accounts
on “'Log in with ' Feature Allows Full Online Account Takeover for Millions”
