7

I've filled this form and I've got the 'Thank you' confirmation page.

Then each time when I'm revisiting the form, all the old form data is still there. So clicking 'Talk to an expert' each time submits the same data over and over again.


I also don't see the logout button (at /advertise/create-a-custom-campaign) and on the main page I can only see the Login button which indicates I'm not login, despite the personal data is populated through cookies.

As for workaround, removing all the cookies (such as __hssc, __hssrc, __hstc, _ga, _gat, hsPagesViewedThisSession, hsfirstvisit, hubspotutk) worked.


UPDATE as per @Patrick answer:

There is no sensitive data exposed, so please keep it like this.

There is actually sensitive data exposed, since this happens when you are not logged in and this data is not associated with any SO account.

Imagine you're going to internet cafe to fill this form and you send all your details for your custom campaign for your business (including some estimated financial details), and you leave after seeing Thank you page, and now all your sensitive data are exposed to anybody who ever goes to business.stackoverflow.com on the same PC (not only at advertise/create-a-custom-campaign, but on the homepage as well including your e-mail address) as shown below (this happens for any non-logged user and you don't have to have account at all to share your personal details):

Schedule a 15 minute call at business.stackoverflow.com

So I believe this is a bug (not a feature).

I understand keeping the data may be useful for convenience, but in my opinion not after form submission, especially loading the old description field over and over again without possibility removing it (not everybody knows how to clear the cookies).

  • Not sure it's on topic here. Since it's integral part of Stack Overflow, think it's better fit on MSO. – Shadow The Dragon Wizard Jul 6 '16 at 16:33
  • Here is fine. I pinged folks who take care of this particular page/domain to ask them to respond. – Adam Lear Jul 7 '16 at 4:03
2

Cookie retention of this information is currently by design.

Yes, the information is kept in cookies by the service we use for this subdomain and used to re-populate common fields where that information occurs again (there are multiple kinds of forms across this subdomain).

It is also true that in an edge case where this information is submitted on a public computer that the information would still be retained. We're looking into adding a post-submission notice reminding users that if they are using a public computer to submit the form, that they should remember to clear cookies for their safety.

As for the HTTPS issue, as it was mentioned in another response, that is currently status-planned and it's one of our top issues at the moment. We're aware contact information shouldn't be sent over plain HTTP and we're actively working on this issue. It's a complicated issue given our implementation, and we expect that to be resolved in the next few weeks.

2

You're right to worry. Unfortunately, you're worrying about the wrong thing.

First of all, you should not submit anything confidential on a public computer. They can have all sorts of spyware, notably key loggers. If one is installed, you are compromised the second you type your data, even without sending it.

Actually, you should just avoid public, unsecured networks and computers altogether if you have a concern for security.

The thing to really worry about here is the lack of HTTPS.

(Or was, at the time this answer was written. The page now appears to use HTTPS, making what I wrote below irrelevant here.)

You can clear your cookies, and do all sorts of security things, but in the end, your data is not secure. You can't even force HTTPS, since it redirects to the HTTP version of the page.

This has been [status-planned], but nobody seems to have realized they completely forgot to touch the business forms pages.

Seriously, I'm not too concerned about someone intercepting some regex answer I made on Stack Overflow, but I do mind that they want me (if I had a need for the service at least) to send out my name, email, and phone number out over HTTP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .