T
Tom Anthony
tomanthony.co.uk · Personal blog · on HN since 2012
Tom Anthony, an SEO and security researcher, writes up vulnerabilities in Google, Facebook, and Zoom.
What HN saysHN commenters discuss his Google sitemap bug and bug bounties, with some calling the $5000 payout low and Google's fix slow.
17HN people shared it
6linked it in comments
23stories submitted
1.9Kstory points
3 years agolast shared
2012people per year2026
Most-shared posts
- 1Google bug bounty for security exploit that influences search results5 people · 252 points · first shared 2018 · 67 comments on HN
- 2Googlebot’s JavaScript random() function is deterministic4 people · 333 points · first shared 2018 · 108 comments on HN
- 3XSS attacks on Googlebot allow search index manipulation3 people · 235 points · first shared 2019 · 40 comments on HN
- 4The Time I Hacked Google’s Manual Actions Database3 people · 7 points · first shared 2023 · discussion on HN
- 5Social Network Login Status Detector3 people · 2 points · first shared 2012 · discussion on HN
- 6Zoom Security Exploit: Cracking private meeting passwords2 people · 420 points · first shared 2020 · 158 comments on HN
- 7Facebook exploit – Confirm website visitor identities2 people · 219 points · first shared 2019 · 51 comments on HN
- 8Exploit to detect which Social Networks you are logged into2 people · 62 points · first shared 2012 · 11 comments on HN
- 9How to confirm a Google user’s specific email address1 people · 227 points · first shared 2017 · 68 comments on HN
- 10Google Exploit – Steal Account Login Email Addresses1 people · 132 points · first shared 2014 · 21 comments on HN
- 11Tool for browser share over time for your website1 people · 6 points · first shared 2012 · 2 comments on HN
- 12Hijack the Google Login flow1 people · 1 points · first shared 2018 · discussion on HN
- 13Social metrics chrome extension1 people · first shared 2012
- 14Googlebot puzzle1 people · first shared 2018
What HN people wrote when they linked it
TomAnthony · 2022-02-10
I think this might have been true in the past, but I don't think it is true any longer. Zoom grew at a wild pace during the early days of the pandemic, and with that came security issues. However, they recognised that and invested into security.
I have previously reported bugs to Google, including one where they simply didn't put any auth on an API endpoint for a new feature, allowing access to any account's data. That is a massive oversight, but at Google scale we realise these things happen, and the more important consideration is how companies respond.
Zoom have a private bug bounty program, but I previously disclosed Zoom bugs publicly [1] as I didn't think their bug bounty program was worthwhile engaging with.
However, they overhauled it, and now of the dozens of private programs I am part of, Zoom's is one of the absolute best. The payouts are great, the team actively engages with the researchers, and seem to legitimately care about getting things right.
Are they perfect? Of course not. But I would feel safer on a Zoom call that call with many competitors who simply don't get as much scrutiny.
[1] https://www.tomanthony.co.uk/blog/zoom-security-exploit-crack-private-…
robocat · 2019-03-10
http://www.tomanthony.co.uk/blog/facebook-bug-confirm-user-identities/
Mentions how inconsistent usage of the XSSI prevention caused a information leak that could detect which user was logged into Facebook - received a bug bounty of $1000 from Facebook.
Previous discussion: https://news.ycombinator.com/item?id=19306309
chipperyman573 · 2019-03-05
A bug by the same author (referenced in the article) that allowed anyone to undetectably upload a sitemap to any other person's website (and appear at the top of search results by claiming to be associated with the website) only got $5000, when it could have easily been sold for tens of thousands to blackhat SEO companies. So the answer is probably "way less than street value but still nonzero"
http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-…
foepys · 2018-04-21
Denying the deadline extension to May 8th [1] is quite a dick move by Google, considering that it took them 6 months to fix the extremely harmful sitemap ranking bug in their search engine[2]. And after they fixed the bug, they only paid peanuts to the researcher for a bug that could've cost Google's customers tens of millions in misplaced ad campaigns.
1: https://bugs.chromium.org/p/project-zero/issues/detail?id=1514#c3
2: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-…
will_critchlow · 2018-03-27
More technical details here: http://www.tomanthony.co.uk/blog/google-xml-sitemap-auth-bypass-black-…
(Tom works at my company)
chrisdroukas · 2012-02-20
Are you referring to the image on that page? If so, go here:
http://www.tomanthony.co.uk/tools/detect-social-network-logins/
It's accurate for me.