-17

I viewed the source of a page on Stack Exchange and I discovered that all the up-vote buttons share the same CSS class and so do all the down-vote buttons.

That got me thinking: what if user(s) cheat on Stack Exchange by "hacking" with JavaScript in the browser console? In the scenario above, user(s) can simply jQuery the down-vote buttons and fire click events on all of them.

I know Stack Exchange will get rid of the votes if they detect serial-voting, but shouldn't these hypothetical "hackers" be banned because they were hacking? How does Stack Exchange differentiate between fake clicks and real user interaction?

RELATED: After a bit of searching around, I found this question: How to mine Unicoins faster? Although "Unicoins" were implemented as an April Fools joke, it does reveal the security issue that I was talking about. The answers suggested JS scripts that could be run to generate Unicoins.

Improve this question
4
  • 1
    Fortunately, I don't believe there have been any successfully malicious hacks since the private beta.
    – Jeremy
    Commented Jun 4, 2016 at 5:11
  • 8
    That is just directly performing the actions via JS, instead of using the user interface. No hacking here, and that is why there is strict limits in place, server side.
    – Shadow Wizard
    Commented Jun 4, 2016 at 5:35
  • 1
    If Stack Exchange were vulnerable to this kind of "hacking" that would be a major security failure.
    – Pekka
    Commented Jun 4, 2016 at 8:59
  • 2
    Hacking SE is totally allowed. Many of the apps listed on stackapps.com use javascript to alter/enhance SE. Hell, I've got a script on there that allows me to close vote questions with a single click.
    – user1228
    Commented Jun 6, 2016 at 15:08

1 Answer 1

Reset to default
16

You can't hack the parent site when using Stack Snippets since those are loaded in a sandboxed iframe.

You also can't hack from the browser console since voting HTTP requests has to come from the same origin, so you can't make cross site requests (CSRF).

The only possible way to 'hack' is when you yourself have access to the browser and its console and make calls from the console there, when you are logged on to SE. That can't be considered hacking. If you have full control over your browser, you can do everything.

Improve this answer
2
  • 4
    Regarding the last point, I guess it is possible that Stack Exchange could choose to implement "self-xss" deterrents as sites like Facebook have, but I don't think that's necessary
    – Jeremy
    Commented Jun 6, 2016 at 11:06
  • 1
    Indeed, although I think that isn't really necessary on sites as SO, but who knows :)
    – Patrick Hofman
    Commented Jun 6, 2016 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .