Maybe you should write in your native language, and let everyone else to learn the language. I don't like when people criticize your writing skills when it's not your native language.
I don't think the criticism was intended in a negative spirit. Getting a native speaker of the language to help edit your writing is a very helpful suggestion. It's a good way to improve your own language skills, while still making your writing available to other audiences. I would definitely encourage people to still publish in their native language though. As you point out, it encourages others to learn other languages and will be very helpful to your fellow countrymen.
It might not be correct English, but it's not even remotely difficult to understand what was meant. (In fact, I didn't even notice it was wrong until you pointed it out.)
Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.
As you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.
For a CSRF attack it actually does because it needs to be executed inside an unsuspecting victim's browser. That wouldn't be sending an custom Instagram user-agent.
I was wondering how generous was the reward Facebook gives for helping them find this kind of security issues, can you share that? (If you consider that you don't want to share this kind of information is completely fine for me, im just curious).
Thanks and congrats, good research!
Well there seems to be a certain exploit going around on FB. it a picure that claims "hack anyone's account by opening their profile and copy pasting this code into the webconsole" where said code uses you logged in credentials to make FB API calls. The version i saw made you like a bunch of pages, follow a bunch of people and tag all of your friends in the comments to that picture. But I wonder if same can be used to change the privacy settings
You would be surprised,what some people leave behind. I'm doing some work on an app that has in-app payments, but the payments are not verified on the server to unlock o_0. This is just a big no no. I just wonder how many other companies have this same simple error.
Phrases like "Due I guessed the website could be already audited and secure" are difficult to understand.
I think you meant, "[Since/because] I guessed the website [would already be]..."