Nice hack! We should call it 'Same-site request forgery'.

I emailed PG about this a week ago, his response:

"It just seems to."

Normally loading the vote URL directly doesn't work because votes that don't have a HN referrer don't get counted. By submitting the URL to HN and getting people to click through a HN referrer gets sent making the votes look legitimate.

I had always assumed this was impossible because my votes have an auth key attached. Does this mean that the auth key is not used and is just there to trick casual observers into thinking there is security?

    vote?for=3742852&dir=up&by=citricsquid&auth=478876d54494692615d9f2ca184fa9fab2fb9ff7&whence=%69%74%65%6d%3f%69%64%3d%33%37%34%32%37%34%32

PG could start using POST & CSRF protection to lock this down. Or we could just avoid doing this to each other.

An interesting bug, but if anything won't it just earn you fake points on a website, while making everyone on that website hate the account that's accruing the points, essentially making those "hacked" points' meaning moot anyway?

I saw this but don't really consider it much of a problem. It's the kind of thing that you can't really exploit. It'd be obvious if you really tried to use it for evil and then PG would kill your account.

Now that it's out there, I made a self up voting version: http://news.ycombinator.com/edit?id=3742902

Is that how this story became number 1 without a pg comment? If this was serious you would think pg would have commented.

I'm fairly certain that unless the referer is the "new" page, it counts negatively toward the story's promotion.

What is the link?