Questions tagged [security]
For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!
233 questions
27
votes
0
answers
447
views
Stop future internet-archived SE network pages from self-navigating to the live version of the snapshot page
When I save a snapshot of a network page on web.archive.org, the snapshot navigates to the live page. Like this. This also happens for snapshots saved before I started noticing this issue (like this).
...
- 29.2k
28
votes
0
answers
285
views
Let’s Encrypt chain of trust changes will affect a small number of users on Stack Exchange
tl;dr: As early as September 9th, some users accessing the site from old Android devices (running Android 7.0 and earlier) may see SSL warnings in their browser regarding an invalid certificate when ...
- 10.4k
-20
votes
2
answers
268
views
Is Stack Exchange vulnerable to manipulation by an artificial general intelligence? [closed]
I recently read the post Is Stack Overflow's reputation system vulnerable to manipulation? which was reassuring, but I'm wondering if it is likely that the tools and the people who use them could be ...
- 364
16
votes
0
answers
390
views
Feature request - A simple credential leak detection in the answer tab
I recently analyzed Stack Overflow for leaks,
and the sites contain a lot of leaks (Stack Overflow did contain most of them, but still askubuntu.com and unix.stackexchange.com do contain some leaks).
...
- 277
12
votes
0
answers
88
views
Use a different CAPTCHA provider for privacy and security [duplicate]
Note: this is not a duplicate of Replacing reCAPTCHA or Please use another captcha than reCaptcha, because this post is chiefly about privacy and security concerns, and not usability, challenge ...
-8
votes
2
answers
223
views
What responsibility does SE/SO have in ensuring users understand they may be inadvertently sharing sensitive information in their posts?
SO/SE is a great resource for folks. These folks often [inadvertently] share information they might not have meant to.
A good example is when someone posts a question in any of the communities with a ...
- 137
-5
votes
1
answer
124
views
Trustworthiness of proposed links?
If a question is asked and someone proposes a link to some executable etc. as a solution to the question, has there been a case that malware was being suggested (perhaps unknowingly too)?
Is there a ...
- 107
172
votes
4
answers
14k
views
Recent site instability, major outages – July/August 2022
On Friday, July 29th, starting at 13:36 UTC, we experienced a very large surge in traffic to our web servers, indicating a DDoS attack. This surge effectively brought down the Stack Exchange Network ...
- 10.5k
62
votes
2
answers
16k
views
Testing new traffic management tool
Stack Overflow will be experimenting with some new HTTP traffic management technologies. Users should not see any negative effects. That said, we felt it would be prudent to announce that the test ...
- 10.5k
26
votes
2
answers
438
views
Who is Samuel Ordonez and why are they a moderator here?
I just noticed this profile:
What is going on?
If it's a new SE staff member, shouldn't they only get staff bit, and not moderator?
Or is this a new hacker?
There are more cases like this on other ...
- 175k
431
votes
2
answers
56k
views
Update on the ongoing DDoS attacks and blocking Tor exit nodes
For the past month, Stack Overflow has been hit by weekly DDoS attacks that progressively grew in size and scope. In each incident, the attacker(s) have been changing their methodology and responding ...
- 10.5k
10
votes
1
answer
134
views
What scope to supply to get a refresh token from Stack Exchange?
In the process of implementing a OAuth app for Stack Exchange, I noticed that none of the approaches that conventionally work - supplying a offline_access scope, for example - result in the OAuth ...
- 103
57
votes
0
answers
1k
views
Stack Overflow and CVE-2021-44228 vulnerability (in Log4J)
Update 2021-12-21:
Mitigation for all Log4j-related 3 CVEs is complete on the following products:
Stackoverflow.com and related (public) websites
Stack Overflow Teams: Free, Basic and Business
Stack ...
- 7,266
11
votes
0
answers
153
views
Use subresource integrity for JavaScript embedded from other domains
SE sites require a whole bunch of JavaScript files to work, with most of them served from a different domain than the main Stack Exchange or Stack Overflow domains. Some of these JavaScript files are ...
- 189k
47
votes
2
answers
1k
views
Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store
Today I came across an Android app which is misusing Stack Overflow's logo and name in the Google Play Store.
Users have reported regarding the security issues they have faced and the developer has ...
- 2,585
30
votes
2
answers
900
views
Removing granted access to an Application is no longer working
When you visit your profile on the tab Settings you'll find the option "Applications".
It lists the Applications you've granted access. Each Application has a button at the right hand side ...
reneMod
- 92k
-1
votes
2
answers
279
views
Option to remove the @username references in the replies from your history, when you change your name [duplicate]
Regarding Change all @username references in comments when a user changes their name? and taking into account the issues raised.
Rather than suggest a change, I suggest a reference removal from every ...
- 454
3
votes
1
answer
79
views
Unrecognized email address in the settings of community digests
Very recently, I visited the email settings of my account in https://stackexchange.com/digests.
To my surprise, I saw in the email settings an email address that I did't recognize (not belonging to me)...
- 131
40
votes
1
answer
782
views
Anyone is able to see ♦ moderator announcements
There is a way for anyone to see ♦ moderator announcements despite not being one:
This can be done by creating a Stack Overflow team (which is now free!), then going to https://stackoverflow.com/c/{...
- 4,798
-10
votes
1
answer
356
views
I deleted my question from Stack Overflow. How can I delete the revision history? [duplicate]
I deleted my question from Stack Overflow having some sensitive information, but I believe the question is not completely removed from Stack Overflow. It also has a revision history, so I want to ...
152
votes
12
answers
4k
views
A deeper dive into the May 2019 security incident: blog post feedback
We just posted an update to the security incident that happened back in May 2019 with technical details of what happened, how it happened, and the remediations we applied to prevent an incident like ...
- 9,799
32
votes
1
answer
492
views
Possible to see any user's site preferences (privacy breach)
Most current user profile-related pages contain user-id in the URL section, e.g. my edit profile page:
https://meta.stackexchange.com/users/edit/339911
If you try to open it you will see a 404 stub:
...
- 69.7k
37
votes
2
answers
677
views
Are there any updates to the May 17, 2019 security incident?
About a year ago, there was a security incident on Stack Exchange.
The last blog post I found on that matter concludes with:
We will provide more public information after our investigation cycle ...
- 7,290
12
votes
1
answer
220
views
How safe is the Stack Exchange app?
After learning some time ago that the Stack Exchange app was no longer being serviced, I got to wondering how safe is the app?
I tried finding an answer but could not seem to find one. Is someone ...
- 230
15
votes
0
answers
122
views
Bug allows anyone to pin any message in any room! [duplicate]
I found a small bug that allows any user to pin a message even if they are not a Room Owner. If a message is pinned and then moved, it remains pinned in the room it is moved to even if the user who ...
- 437
3
votes
1
answer
173
views
Picture are not shown in all Stack Exchange sites [duplicate]
This is a screen shoot of SE I took from here. That's mine. But mine or others are the same, not working, no image is shown. That's makes it difficult for me to understand a topic. I have tried with ...
- 131
7
votes
3
answers
459
views
Why does a particular user profile trigger 'Deceptive Site Ahead' message?
Clicking on the username in a comment by user l'L'l on this question seems to trigger chrome's security alert, stating
Attackers on iplo.ru may trick you into doing something dangerous like
...
- 1,281
9
votes
0
answers
142
views
Question owner can't write in chat created from comments - system picked wrong "Michel Keijzers"? [closed]
See Oscilloscope scrolling
I (as moderator) created a chat from the comments on the question; now the OP of the question claims that he can't write in the chat. I looked at the chatroom properties, ...
- 1,037
4
votes
1
answer
113
views
What security concerns relate to having a "copy code" button?
This answer to a "copy code button" feature request states:
I have learned that this functionality simply will not be implemented due to security concerns.
So what security concerns? I visit '...
- 1,530
5
votes
3
answers
1k
views
How do I better protect myself on Stack Exchange?
This is a FAQ proposal. Its aim is to advise and better protect users across the Stack Exchange network but especially to users who can be as young as 13. It is hoped that this guide will help users ...
- 25.1k
-22
votes
2
answers
479
views
Prefer only 'they' for personal pronouns due to privacy and security
This is specifically regarding updates to the new CoC (Official FAQ on gender pronouns and Code of Conduct changes) addressing personal pronouns.
The point, up front
With Internet hackers, bots, and ...
- 1,475
43
votes
0
answers
429
views
What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?
In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following
@jhpratt And you'll get one. And a lot of ...
- 4,628
-20
votes
1
answer
160
views
Stack Exchange Security vs. Online Forums [closed]
How secure is Stack Exchange compared to online forums such as Reddit or Quora? Better? Worse? How difficult is it to hack and how secure is user information?
- 109
1
vote
0
answers
62
views
Is it possible to have a login which isn’t an E-mail?
I would like to be able to manage my accounts (private information) independently of my e-mails (public information) because:
I would like to avoid any sharing of accounts between different servers,
...
- 221
2
votes
0
answers
53
views
How to change my login and login provider [duplicate]
I have been using an authentication through my Gmail account because
many years ago I thought it was a good method from a security standpoint,
(even if the fact to use an E-mail as an account is a ...
- 221
2
votes
0
answers
97
views
Getting attention for answers that have aways been incorrect [duplicate]
There's a question about what to do about outdated answers, but what if the answer is not outdated but was always incorrect and gave simply wrong information, or more seriously information that might ...
- 129
11
votes
0
answers
254
views
The mobile app shows too informative login error messages
Today when I was moving to a new Android phone, I have noticed that when I typed my account password incorrectly, the message I have received was "Error while attempting to login: Bad password".
Out ...
- 219
24
votes
2
answers
245
views
A suggested edit cuts out allegedly malicious links. How do I safely check that claim and what review action do I take?
I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the ...
- 15.1k
1
vote
1
answer
394
views
Possible to vote to close for old, decommissioned close reasons (with proof of concept)
tl;dr install this user script, and it becomes possible to vote to close for old close reasons such as "not constructive" and "too localized".
After doing some twiddling with Stack Exchange ...
5
votes
1
answer
78
views
URLs for deleted questions get SEO'd automatically - is this a security issue? [duplicate]
When a user visits the link of a deleted questions, he can still see the title in the address bar. For example, when I go to https://stackoverflow.com/q/1, which is a deleted question, it redirects ...
- 59
40
votes
1
answer
265
views
Users are able to register apps that look official (for phishing)
Recently, a user was able to register an app with the name "StackOverflow".
Alarmed, I tried it myself.
If you click this authorization link, you will see:
... which sure looks official.
This is ...
- 20.7k
16
votes
1
answer
736
views
Why would StackExchange logs show me logging in *from* a stack exchange server?
Looking at my login history (at https://openid.stackexchange.com/user) I see I've logged in several times from the IP address "198.252.206.71" but according to a quick whois search, that IP belongs to ...
- 263
2
votes
0
answers
211
views
Broken or wrong links in Security Hall of Fame
The Security Hall of Fame contains two problematic links:
The link to jeremy.ca points back to Stack Overflow.
The link to Russel Van Laurio facebook profile leads to 404 Page Not Found error ...
- 175k
5
votes
2
answers
123
views
Where to ask about improvements for a security scenario?
I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use.
What is the best ...
- 215
16
votes
1
answer
321
views
Prevent users from sharing private keys in cryptocurrency related communities
Being an active member of the Ethereum Stack Exchange community, I stumble upon many threads started by new users containing sensitive information about their digital wallets - private keys and 12-...
- 299
20
votes
2
answers
994
views
Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?
Recently Facebook was hacked with 50M accounts compromised.
I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended.
I'm writing in ...
- 781
3
votes
3
answers
299
views
Email from Stack Exchange with a Python file attached
I received an email from Stack Exchange with a Python file attached, and it seemed suspicious. I thought y'all would want to take a look.
email:
From: "Stack Exchange" <do-not-reply@stackexchange....
- 201
3
votes
1
answer
105
views
How to login to SE sites that don't support SEOpenID without giving them my SEOpenID password?
When I'm already logged into openid.stackexchange.com (aka SEOpenID) then I am able to log into stackexchange.com (aka SE) by simply clicking the button "Login with Stack Exchange". I am not asked for ...
user399844
14
votes
0
answers
121
views
Did Stack Exchange manage to hire a Director of Information Security?
According to How is the security bug bounty program doing?, Stack Exchange is hiring a Director of Information Security.
We are in the process of hiring a Director of Information Security who will ...
- 11.3k
54
votes
1
answer
408
views
Your handling of security reports is disappointing
I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
- 895