More specifically, it's protecting your site from other sites taking advantage of the fact that you're already logged in. For example, in the absence of CSRF, i

More specifically, it's protecting your site from other sites taking advantage of the fact that you're already logged in. For example, in the absence of CSRF, if you're logged into HN, any other site could just embed a form element using the right input IDs, and make submissions on your behalf (clicked on this link? just made a post on your behalf. moved your mouse a little to the left? just upvoted this post). The "hack" outlined in the article requires knowing the username and password of the person you want to "hack". Of course CSRF tokens don't protect you when your credentials are lost.