-16

I viewed the source of a page on Stack Exchange and I discovered that all the up-vote buttons share the same CSS class and so do all the down-vote buttons.

That got me thinking: what if user(s) cheat on Stack Exchange by "hacking" with JavaScript in the browser console? In the scenario above, user(s) can simply jQuery the down-vote buttons and fire click events on all of them.

I know Stack Exchange will get rid of the votes if they detect serial-voting, but shouldn't these hypothetical "hackers" be banned because they were hacking? How does Stack Exchange differentiate between fake clicks and real user interaction?

RELATED: After a bit of searching around, I found this question: How to mine Unicoins faster? Although "Unicoins" were implemented as an April Fools joke, it does reveal the security issue that I was talking about. The answers suggested JS scripts that could be run to generate Unicoins.

  • 1
    Fortunately, I don't believe there have been any successfully malicious hacks since the private beta. – Jeremy Jun 4 '16 at 5:11
  • 6
    That is just directly performing the actions via JS, instead of using the user interface. No hacking here, and that is why there is strict limits in place, server side. – Shadow The Curly Braced Wizard Jun 4 '16 at 5:35
  • 1
    If Stack Exchange were vulnerable to this kind of "hacking" that would be a major security failure. – Pëkka Jun 4 '16 at 8:59
  • 2
    Hacking SE is totally allowed. Many of the apps listed on stackapps.com use javascript to alter/enhance SE. Hell, I've got a script on there that allows me to close vote questions with a single click. – Won't Jun 6 '16 at 15:08
12

You can't hack the parent site when using Stack Snippets since those are loaded in a sandboxed iframe.

You also can't hack from the browser console since voting HTTP requests has to come from the same origin, so you can't make cross site requests (CSRF).

The only possible way to 'hack' is when you yourself have access to the browser and its console and make calls from the console there, when you are logged on to SE. That can't be considered hacking. If you have full control over your browser, you can do everything.

  • 2
    Regarding the last point, I guess it is possible that Stack Exchange could choose to implement "self-xss" deterrents as sites like Facebook have, but I don't think that's necessary – Jeremy Jun 6 '16 at 11:06
  • 1
    Indeed, although I think that isn't really necessary on sites as SO, but who knows :) – Patrick Hofman Jun 6 '16 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .