7

On Stackoverflow, I have flagged a question for security purposes. The user has provided a link to the admin panel of their site along with a username and password. As these credentials are for a super user, anything can be done on the site.

I posted this flag on 15th January and 5 days later, it's still pending (active). I'm fully aware that the Mods have a lots of things to do, however seeing as this poses a rather big threat, I thought I would bump it on here. I assume the Mods have some sort of page with pending flags, therefore I won't post a link to the question on here for security purposes.

Maybe it might be an idea to add another option to the "flag reasons" list, which makes it a top priority and can be dealt with quickly.

marked as duplicate by Danubian Sailor, Martijn Pieters, Aziz Shaikh, gnat, Ilmari Karonen Jan 20 '14 at 12:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You have enough rep on SO to at least remove the link and info from the current revision. Did you do so? – Martijn Pieters Jan 20 '14 at 11:24
  • 2
    And an additional flag type won't help here; what makes you think Joe Soap won't use it for trivial matters? Everyone thinks their flag is urgent. – Martijn Pieters Jan 20 '14 at 11:25
  • Realistically isn't the OP deliberately doing this. I mean they are not exactly being wise, but its not like we can protect people from themselves (beyond perhaps telling them why its deeply unwise) – Richard Tingle Jan 20 '14 at 11:26
  • Is it actually a security issue in this case? Like @RichardTingle says, OP is deliberately giving the (what I assume to be temporary) login credentials in order to find out the cause of a problem with logging in to his admin panel. – Stijn Jan 20 '14 at 11:31
  • 1
    @MartijnPieters - I do indeed, however this can still be seen in the edit history. – Lodder Jan 20 '14 at 11:39
  • Yes, the OP is deliberately providing details, however what's to stop me or anyone else from completely screwing up the website? It's the same as people providing their database details, it can simply result in SQL injection. – Lodder Jan 20 '14 at 11:41
  • @Lodder: sure, but it's a first step. The moderators cannot do any more either, removing text from the post revisions is something requiring a Stack Exchange developer. – Martijn Pieters Jan 20 '14 at 11:42
  • @Lodder I take it you're of the "people shouldn't be allowed to do things that would hurt themselves" school of governance. Regardless, these "log into my website" questions are of no use to anyone but the OP and should really be prevented for normal moderation reasons – Richard Tingle Jan 20 '14 at 11:45
  • @RichardTingle - I simply believe that people should be aware that posting credentials like this can pose major security risks. Questions can be viewed by anybody out there, meaning that anybody can look simply log into the backend, completely remove everything and log out with a smile on their face. Yes, editing the question and removing this information can be done, which does help to a certain extent, but then again, anybody with editing permissions can see this information in the history. Personally, It's always good to stay on the safe side. Anyway, Rory's answer summed it up ;) – Lodder Jan 20 '14 at 11:52
  • @Lodder I suppose I am working under the assumption that the security hole is so huge and obvious that the OP must have known that and done so willingly. But perhaps I am overestimating people (if so: is deeply worried) – Richard Tingle Jan 20 '14 at 11:54
  • 1
    see also: meta.stackexchange.com/questions/132117/… – tombull89 Jan 20 '14 at 11:59
6

Stack Exchange is not in a position to be able to confirm whether this is a security issue, however as it may be one, your best bet is to edit the post yourself, removing the credentials and giving the reason.

This will alert the OP, who can take action.

If they want to, they can speak to a site mod who can escalate to have revision history removed. We have this issue reasonably regularly on Security.SE - where someone posts credentials, links or otherwise sensitive info. If necessary, I or one of the other mods requests the community team remove the history, but this is usually decided after speaking to the OP.

  • Thanks for the info. I will bare this in mind for future reference. I was not aware that removing revision history was possible. – Lodder Jan 20 '14 at 11:47
  • It is only possible by SE employees, but if there is a good reason to do it (such as sensitive information, personal information etc) then it is worth requesting. – Ro-Reinstate Monic-Alsop Jan 20 '14 at 11:49
  • @Lodder - Part of the slow response on a flag like this is that moderators can't remove these revisions ourselves. We have to call in an SE employee, and we don't have a great way of doing that now, short of chat pings or email. I often leave these active even when I've seen them, if I know I'm not going to be able to get a hold of an SE employee right then. Otherwise, it could be forgotten. – Brad Larson Jan 20 '14 at 18:55

Not the answer you're looking for? Browse other questions tagged .