Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

0
votes
0answers
35 views

Where to ask about improvements for a security scenarios?

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. What is the best ...
0
votes
0answers
30 views

Does StackExchange have any plans to offer 2-factor logins? [duplicate]

I've recently got hold of some Feitian U2F dongles and have been busily securing my online accounts. I was somewhat surprised to see that StackExchange currently doesn't seem to offer anything beyond ...
11
votes
1answer
111 views

Prevent users from sharing private keys in cryptocurrency related communities

Being an active member of the Ethereum Stack Exchange community, I stumble upon many threads started by new users containing sensitive information about their digital wallets - private keys and 12-...
18
votes
2answers
359 views

Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Recently Facebook was hacked with 50M accounts compromised. I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended. I'm writing ...
3
votes
3answers
149 views

Email from Stack Exchange with a Python file attached

I received an email from Stack Exchange with a Python file attached, and it seemed suspicious. I thought y'all would want to take a look. email: From: "Stack Exchange" <do-not-reply@stackexchange....
2
votes
1answer
77 views

How to login to SE sites that don't support SEOpenID without giving them my SEOpenID password?

When I'm already logged into openid.stackexchange.com (aka SEOpenID) then I am able to log into stackexchange.com (aka SE) by simply clicking the button "Login with Stack Exchange". I am not asked for ...
11
votes
0answers
99 views

Did Stack Exchange manage to hire a Director of Information Security?

According to How is the security bug bounty program doing?, Stack Exchange is hiring a Director of Information Security. We are in the process of hiring a Director of Information Security who will ...
52
votes
1answer
358 views

Your handling of security reports is disappointing

I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
12
votes
1answer
198 views

Dealing with highly sensitive personal information in a post

Recently, I found a user had posted a complete copy of their credit card magstripe in a question on Security SE. As I did not have 2k rep on that site at the time I could not force an edit to hide the ...
14
votes
1answer
177 views

How is the security bug bounty program doing?

Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...
18
votes
1answer
251 views

I reported a security issue but didn't hear back

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
4
votes
0answers
50 views

Subscription removal susceptible to CSRF attacks?

It seems to me that the subscriptions tab in the profile settings page is susceptible to CSRF attacks since the links to remove yourself from subscriptions are just plain html links. Please correct if ...
8
votes
3answers
208 views

Keeping answers related to security up to date

A paper was recently published partly about Stack Overflow, specifically relating to how a number of the accepted answers in relation to Java security were out of date and even dangerous given recent ...
241
votes
6answers
10k views

Setting Up a HackerOne Security Bug Bounty Program

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
-3
votes
2answers
980 views

Enabling Dance Dance Authentication [closed]

So I saw the Dance Dance Authentication post: https://stackoverflow.blog/2017/03/30/stack-overflow-unveils-next-steps-computer-security, and I thought it sounded pretty cool. But, I can't figure out ...
-16
votes
1answer
120 views

Why hadn't SE had HTTPS for a long time?

I'm novice in security, but after reading the post Network-wide HTTPS: It's time I'm confused. As in the answer of Better HTTPS support for Stack Exchange sites, having an SSL certificate is not ...
14
votes
1answer
181 views

Was the Stack Exchange network affected by the Cloudflare parser bug?

Cloudflare disclosed a memory leak incident in their software, which could lead to: returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies,...
-6
votes
1answer
133 views

“this user prefers to keep an air of mystery about them” - can this wording be changed?

I'm posting this question anonymously for obvious reasons. It should be on meta, but I can't post there anonymously. It would be great if someone would move it there. The new head of the Department ...
2
votes
0answers
34 views

Why does this site not require login after new browser session? [duplicate]

To clarify: I've set this site to not remember me. This seems to be ambiguous on different sites now as that can either mean to not keep track of my credentials locally and to keep me logged in or to ...
23
votes
1answer
225 views

How did TIBCO / Marketo obtain my Stack Exchange profile e-mail address for spamming?

My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not ...
16
votes
1answer
254 views

How will Stack Exchange ensure security of adverts?

I have absolutely no problem with the principle of proper adverts (i.e. Adverts that are relevant to the audience, and only appearing in the small sidebar like existing ones etc.) however the concern ...
5
votes
0answers
94 views

Enable Content Security Policy on Stack Exchange

I think it would be a good idea to enable Content Security Policy on Stack Exchange. With CSP it's possible to disable inline scripts, and that can improve security. For example, some time ago I ...
3
votes
0answers
126 views

McAfee SiteAdvisor has a false positive on certain skeptics.SE questions

McAfee SiteAdvisor seems to suggest that this question on skeptics.SE is a security risk, and them it nags me that there is a risk. This happens for several other questions as well. The site report ...
1
vote
1answer
80 views

Getting popups and popunders on SE homepages today only - is it just me? [closed]

On two separate devices (Android and Windows 7, Opera and Firefox, logged in and logged out) on two separate internet connections, I'm getting pop-ups and pop-unders (this page opened in a new tab, ...
4
votes
1answer
61 views

Where can I ask about how to deal with Magento hacking and security?

Recently my client's Magento store was hacked and I want to know more information about this Magento hacking. So where should I ask questions about Magento hacking, Information Security or Magento?
12
votes
1answer
69 views

Remind people posting about [security] that vulnerabilities shouldn't be posted on Meta

This question was posted here on Meta today, detailing a security vulnerability in chat. stackexchange.com/about/security says: Please do not post serious security issues publicly on a meta site ...
19
votes
2answers
400 views

Chat links expose a pretty serious JavaScript exploit

So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this I linked ...
3
votes
1answer
77 views

Yahoo breach - what are the consequences for Stack Exchange OpenID logins?

So Yahoo was hacked by a state sponsored attacker, and half a billion credentials were compromised. These credentials also allow access to the OpenID network, which is one of the ways you can login to ...
7
votes
1answer
366 views

If an account gets hijacked and used for posting illegal material, will Stack Exchange be willing to cooperate with local attorneys?

It makes several years that this post is status-planned. There are reason to consider it won’t be status-completed in the upcoming years. So whatever I can do, my account can be hijacked anytime ...
-15
votes
1answer
197 views

Exploiting Stack Exchange with the browser console

I viewed the source of a page on Stack Exchange and I discovered that all the up-vote buttons share the same CSS class and so do all the down-vote buttons. That got me thinking: what if user(s) ...
44
votes
1answer
446 views

Establishing a Security Bug Bounty Programme for Stack Exchange [duplicate]

Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here. At the moment SE has a security contact page which details how to contact SE regarding security issues, ...
3
votes
0answers
33 views

Is this an attempt at fraud/impersonation? stockoverflows.com [duplicate]

I just stumbled upon stockoverflows.com, which seems to be an attempt to impersonate the Stack Overflow website. Should something be done about this? At first thought, I'm concerned about the ...
18
votes
1answer
171 views

Don't tell me which of my credentials is wrong

If I mistype my username or password when logging in to Stack Exchange, the red dialogue box tells me which was incorrect. If an attacker correctly guesses an email address present in the database ...
33
votes
0answers
379 views

Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking

When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication. This is not a full ...
10
votes
0answers
45 views

Add a 'I have found a security-related issue' line to the reasons combobox in the 'Contact us' form

Related: Should I report a serious security issue on meta? How do I report a possible security vulnerability? Rationale: discoverability without having to jump through several hoops. Side note: ...
25
votes
3answers
304 views

How to handle possible user tracking through images?

I have come across a site-meta question that ended up on the Hot Meta Posts side bar. At the time of writing, that post has about 1000 views. Accidentally I noticed that OP used his own server (his ...
33
votes
3answers
166 views

Let's show users an audit of account activity

So, someone had a bit of a startle the other day after realizing someone was trying to troll them by creating a parody profile. These shenanigans are fortunately pretty rare in that they actually turn ...
6
votes
0answers
41 views

It would have been nice to know that shared links include my user id [duplicate]

I noticed that every short-link/permalink that I share while I'm logged in includes my user id. It would have been really nice if the UI had highlighted this fact in the link sharing popup so that ...
3
votes
0answers
33 views

Bad SSL/TLS at Stack Exchange: Cloudflares SSL certificates and sometimes no HTTPS at all [duplicate]

Cloudflare Cloudflare has the options Universal/Flexible SSL, which basically allow websites to serve their website over HTTPS by using a certificate from Cloudflare. Besides the fact that ...
4
votes
2answers
53 views

How does Stack Exchange prevent all its contents from being stolen through its API?

There's something I have hard time to understand with this world of APIs: when you have your WebApp/MobileApp ecosystem entirely based on an API giving access to your database, how do you prevent all ...
2
votes
0answers
121 views

Allow framing of links to current site in stack snippets

Over at PPCG.SE (CodeGolf.SE), we regularly use stack snippets for leaderboards for our programming challenges. However, the snippets feature prevents our leaderboards from having links to the answers....
8
votes
1answer
50 views

Make information on own login history and other sessions visible to user

I think that a really important security feature, which SE lacks, is that there is no login history. Well, at least, it is not displayed to normal users about their accounts and only to moderators. ...
-2
votes
2answers
83 views

How to escape cyberstalking without losing points and reputation?

Suppose someone is cyberstalking me on Stack Exchange. They could gain quite a lot of insight on what I am doing by simply reading my posts. I could create a new account, but that would mean losing ...
0
votes
0answers
42 views

“funmontage” is not fun, was this clone/impersonator of all SE detected before? [duplicate]

I noticed that all sites of stackexchange were replicated in detail with "funmontage.com" (all internal links are pointing to their own domain, even signup and login pages). Here are some examples: ...
16
votes
1answer
131 views

Possible CSRF attack that cause answers to be added to “Top Answers” section

In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta If ...
15
votes
2answers
196 views

weak sign up page password placeholder text

According to this article the password 12345 was the third most popular password in use in the year of 2014. So why does SE use such a weak and commonly used password as a placeholder hint? ...
8
votes
1answer
125 views

Stack Exchange app submitting password in cleartext?

I have just noticed (by using the Charles web debugging proxy) that the Stack Exchange app is submitting username and password in cleartext at first startup. Isn't that something you shouldn't do, ...
8
votes
0answers
89 views

Time to upgrade SSL Cert(s) on *stackexchange.com

When browsing any StackExchange site, my Firefox console displays this warning: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use ...
10
votes
1answer
123 views

What the @#$% is threadfrage.com?

While Googling for an earlier answer of mine on mathematica.stackexchange.com I got a hit pointing to http://mathematica.threadfrage.com/ which offers what looks like a complete mirror of the ...
5
votes
1answer
102 views

How many user accounts on SE sites get hacked per year?

I've run a few queries for users with spam penalties across SE sites (SEDE link) and it occurred to me that there may be some accounts that were hacked into and used for posting spam. While this is ...