Top all-time · #16944
These aren't the access_tokens you're looking for
Personal blog · philippeharewood.comsecurityweb
These aren't the access_tokens you're looking for is a personal blog at philippeharewood.com about security and web. Since 2012, 4 different Hacker News readers have linked it 37 times, most often “Subscribe to typing notifications for any Instagram user”. It is still writing: the last post was on 2025-11-14, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for web application security writing, including the Google YOLO clickjacking post. One commenter lists it among their favourite security blogs.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Subscribe to typing notifications for any Instagram user2 people · 2 mentions · first linked 2019-12-06
- Security researcher penalised $3750 by Facebook for verifying vulnerability2 people · 2 mentions · first linked 2021-07-21
What Hacker News says?
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”Submitted Security researcher penalised $3750 by Facebook for verifying vulnerability as a story · 46 points
HN discussionThis is pretty much the same method a user can use to provide a negative comment using the Like Button comment feature on a company, though actually a lot worse and a bit more annoying. This also appears in "X is posting about Y" which I wrote about a while back [1], grinds my gears really. The ad push is more aggressive than I am comfortable with On the flip side, because how these sponsored stories/posts work, if…
Comment linking /facebook/make-it-red-and-viral/
on “How to Spam your Facebook Friends for a Week”Submitted Getting Your Facebook Page On Your Website With Access Tokens as a story · 5 points
HN discussionSubmitted How can Facebook support suck so badly as a story · 4 points
HN discussionSubmitted Leaked Credentials gives access to internalfb.com as a story · 3 points
HN discussionSubmitted Subscribe to typing notifications for any Instagram user as a story · 3 points
HN discussionSubmitted Facebook Business Takeover ($27,500 bounty) as a story · 3 points
HN discussionSubmitted Facebook and Python – The Basic Sauce as a story · 3 points
HN discussionSubmitted Facebook SSRF as a story · 2 points
HN discussionSubmitted View Facebook friends for any user as a story · 2 points
HN discussionSubmitted View Private Instagram Photos as a story · 2 points
HN discussionSubmitted De-anonymizing Facebook Ads as a story · 2 points
HN discussionSubmitted Hacker News as a story · 2 points
HN discussionSubmitted Coding Exercises Exposed at Facebookrecruiting.com as a story · 1 points
HN discussionSubmitted Bulletin.com Email Address Leak as a story · 1 points
HN discussionSubmitted Facebook’s /intern/testdata tool: default password n0t3st as a story · 1 points
HN discussionSubmitted Download Facebook internal mobile builds as a story · 1 points
HN discussionSubmitted Subscribe to typing notifications for any Instagram user as a story · 1 points
HN discussionSubmitted Facebook GraphQL CSRF as a story · 1 points
HN discussionSubmitted Posting GIFs as anyone on Facebook as a story · 1 points
HN discussionSubmitted How I Could Have Seen All Mark Zuckerberg Facebook Messenger Purchases as a story · 1 points
HN discussionSubmitted Facebook API v2 bug: Inconsistency with App Scoped User ID – Privacy Leakage as a story · 1 points
HN discussionSubmitted Facebook Pages Vulnerability – Invite any user to a Facebook page as a story · 1 points
HN discussionSubmitted Getting Access To Facebook Keyword Insights Data Using A Regular Access Token as a story · 1 points
HN discussionSubmitted Facebook Insights $4000 Graph API bug as a story · 1 points
HN discussionSubmitted Getting your Facebook News Feed in PHP – The Basic Sauce as a story · 1 points
HN discussionSubmitted Facebook FQL Performance Comparison as a story · 1 points
HN discussionSubmitted Six Degrees of Facebook as a story · 1 points
HN discussionSubmitted Tupac is posting about Lil Wayne (Facebook Sponsored Stories Evolved) as a story · 1 points
HN discussion