First screen, captured 2 days ago. Hover to scroll the page, or open the video.

Do the math: How we took over ChatGPT accounts

What HN thinks

A $5,000 thank-you note for an account takeover, and the thread has opinions about the tip.

The $5,000 bounty is insultingly low
Most commenters think a P1 account-takeover bug at a trillion-dollar company deserves far more, and warn that lowball payouts push researchers toward the black market.
Selling exploits is still unethical or illegal
Others push back that the low payout doesn't justify selling the exploit, since the victims would be ordinary users and the seller could face criminal charges.
Write-up is hard to follow and AI-flavoured
Several readers found the post confusing and likely AI-written, and one said the company behind it runs unsolicited pentests as a sales tactic.

Consensus: Most agree the bounty is too small for the severity of the bug. Several also enjoyed the chain of old-school web tricks used in the exploit: postMessage, JSONP, iframes and img tags.

Summarised by Claude from the comment thread 1 day ago.

Points: 346
Comments: 168
Best rank: #2
Posted: 2026-10-31 by armcat

All captures:

Full page

Captured 2 days ago. Click for the whole screenshot.

Looks similar

Screenshot of pwn.watch: What’s getting pwned right now

What’s getting pwned right now (pwn.watch)

353 points by mrkd 11 days ago | 165 comments

pwn.watch is a live feed of ongoing security incidents and CVEs, listing affected software, patch status, fixed versions, and source advisories.

vulnerability-tracker cve security-incidents supply-chain

Screenshot of mastodon.social: The rise of ChatGPT-enabled GitHub spam

The rise of ChatGPT-enabled GitHub spam (mastodon.social)

96 points by luu 3 years ago | 64 comments

Screenshot of disobey.net: ChatControl update: blocking minority held but Denmark is moving forward anyway

ChatControl update: blocking minority held but Denmark is moving forward anyway (disobey.net)

459 points by nickslaughter02 1 year ago | 318 comments

Mastodon post relaying an ISOC Global Encryption Coalition update that the EU ChatControl blocking minority held while Denmark pushes the proposal to the October 14th JHA Council.

chat-control eu-regulation encryption denmark

Screenshot of mathstodon.xyz: Terence Tao: Solving problems by abstracting away highly relevant information

Terence Tao: Solving problems by abstracting away highly relevant information (mathstodon.xyz)

5 points by bertman 1 year ago | 0 comments

Screenshot of mastodon.catgirl.cloud: A complete bypass of eMudhra’s 1FA OTP login system

A complete bypass of eMudhra’s 1FA OTP login system (mastodon.catgirl.cloud)

131 points by tensegrist 10 days ago | 53 comments

Mastodon thread describing a bypass of eMudhra's OTP login by encrypting OTP requests with an exposed public key, enabling brute-forcing of logins to steal certificates.

emudhra otp-bypass brute-force certificate-authority