Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
25 votes
2 answers
365 views

Who is Samuel Ordonez and why are they a moderator here?

I just noticed this profile: What is going on? If it's a new SE staff member, shouldn't they only get staff bit, and not moderator? Or is this a new hacker? There are more cases like this on other ...
user avatar
422 votes
2 answers
52k views

Update on the ongoing DDoS attacks and blocking Tor exit nodes

For the past month, Stack Overflow has been hit by weekly DDoS attacks that progressively grew in size and scope. In each incident, the attacker(s) have been changing their methodology and responding ...
user avatar
  • 3,869
10 votes
1 answer
76 views

What scope to supply to get a refresh token from Stack Exchange?

In the process of implementing a OAuth app for Stack Exchange, I noticed that none of the approaches that conventionally work - supplying a offline_access scope, for example - result in the OAuth ...
user avatar
  • 103
55 votes
0 answers
988 views

Stack Overflow and CVE-2021-44228 vulnerability (in Log4J)

Update 2021-12-21: Mitigation for all Log4j-related 3 CVEs is complete on the following products: Stackoverflow.com and related (public) websites Stack Overflow Teams: Free, Basic and Business Stack ...
user avatar
  • 6,692
10 votes
0 answers
50 views

Use subresource integrity for JavaScript embedded from other domains

SE sites require a whole bunch of JavaScript files to work, with most of them served from a different domain than the main Stack Exchange or Stack Overflow domains. Some of these JavaScript files are ...
user avatar
44 votes
2 answers
707 views

Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store

Today I came across an Android app which is misusing Stack Overflow's logo and name in the Google Play Store. Users have reported regarding the security issues they have faced and the developer has ...
user avatar
  • 2,551
30 votes
2 answers
702 views

Removing granted access to an Application is no longer working

When you visit your profile on the tab Settings you'll find the option "Applications". It lists the Applications you've granted access. Each Application has a button at the right hand side ...
user avatar
  • 79.4k
-2 votes
2 answers
209 views

Option to remove the @username references in the replies from your history, when you change your name [duplicate]

Regarding Change all @username references in comments when a user changes their name? and taking into account the issues raised. Rather than suggest a change, I suggest a reference removal from every ...
user avatar
  • 426
3 votes
1 answer
69 views

Unrecognized email address in the settings of community digests

Very recently, I visited the email settings of my account in https://stackexchange.com/digests. To my surprise, I saw in the email settings an email address that I did't recognize (not belonging to me)...
user avatar
  • 131
39 votes
1 answer
739 views

Anyone is able to see ♦ moderator announcements

There is a way for anyone to see ♦ moderator announcements despite not being one: This can be done by creating a Stack Overflow team (which is now free!), then going to https://stackoverflow.com/c/{...
user avatar
  • 3,484
-9 votes
1 answer
167 views

I deleted my question from Stack Overflow. How can I delete the revision history? [duplicate]

I deleted my question from Stack Overflow having some sensitive information, but I believe the question is not completely removed from Stack Overflow. It also has a revision history, so I want to ...
user avatar
148 votes
12 answers
3k views

A deeper dive into the May 2019 security incident: blog post feedback

We just posted an update to the security incident that happened back in May 2019 with technical details of what happened, how it happened, and the remediations we applied to prevent an incident like ...
user avatar
  • 9,630
31 votes
1 answer
315 views

Possible to see any user's site preferences (privacy breach)

Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page: https://meta.stackexchange.com/users/edit/339911 If you try to open it you will see a 404 stub (I ...
user avatar
37 votes
2 answers
655 views

Are there any updates to the May 17, 2019 security incident?

About a year ago, there was a security incident on Stack Exchange. The last blog post I found on that matter concludes with: We will provide more public information after our investigation cycle ...
user avatar
  • 7,131
12 votes
1 answer
161 views

How safe is the Stack Exchange app?

After learning some time ago that the Stack Exchange app was no longer being serviced, I got to wondering how safe is the app? I tried finding an answer but could not seem to find one. Is someone ...
user avatar
  • 230
15 votes
0 answers
118 views

Bug allows anyone to pin any message in any room! [duplicate]

I found a small bug that allows any user to pin a message even if they are not a Room Owner. If a message is pinned and then moved, it remains pinned in the room it is moved to even if the user who ...
user avatar
  • 437
3 votes
1 answer
139 views

Picture are not shown in all Stack Exchange sites [duplicate]

This is a screen shoot of SE I took from here. That's mine. But mine or others are the same, not working, no image is shown. That's makes it difficult for me to understand a topic. I have tried with ...
user avatar
7 votes
3 answers
365 views

Why does a particular user profile trigger 'Deceptive Site Ahead' message?

Clicking on the username in a comment by user l'L'l on this question seems to trigger chrome's security alert, stating Attackers on iplo.ru may trick you into doing something dangerous like ...
user avatar
  • 1,083
9 votes
0 answers
136 views

Question owner can't write in chat created from comments - system picked wrong "Michel Keijzers"? [closed]

See Oscilloscope scrolling I (as moderator) created a chat from the comments on the question; now the OP of the question claims that he can't write in the chat. I looked at the chatroom properties, ...
user avatar
4 votes
1 answer
105 views

What security concerns relate to having a "copy code" button?

This answer to a "copy code button" feature request states: I have learned that this functionality simply will not be implemented due to security concerns. So what security concerns? I visit '...
user avatar
  • 1,518
5 votes
3 answers
1k views

How do I better protect myself on Stack Exchange?

This is a FAQ proposal. Its aim is to advise and better protect users across the Stack Exchange network but especially to users who can be as young as 13. It is hoped that this guide will help users ...
user avatar
-23 votes
2 answers
364 views

Prefer only 'they' for personal pronouns due to privacy and security

This is specifically regarding updates to the new CoC (Official FAQ on gender pronouns and Code of Conduct changes) addressing personal pronouns. The point, up front With Internet hackers, bots, and ...
user avatar
  • 1,179
39 votes
0 answers
398 views

What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?

In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following @jhpratt And you'll get one. And a lot of ...
user avatar
  • 4,528
-20 votes
1 answer
133 views

Stack Exchange Security vs. Online Forums [closed]

How secure is Stack Exchange compared to online forums such as Reddit or Quora? Better? Worse? How difficult is it to hack and how secure is user information?
user avatar
1 vote
0 answers
59 views

Is it possible to have a login which isn’t an E-mail?

I would like to be able to manage my accounts (private information) independently of my e-mails (public information) because: I would like to avoid any sharing of accounts between different servers, ...
user avatar
  • 221
2 votes
0 answers
53 views

How to change my login and login provider [duplicate]

I have been using an authentication through my Gmail account because many years ago I thought it was a good method from a security standpoint, (even if the fact to use an E-mail as an account is a ...
user avatar
  • 221
2 votes
0 answers
91 views

Getting attention for answers that have aways been incorrect [duplicate]

There's a question about what to do about outdated answers, but what if the answer is not outdated but was always incorrect and gave simply wrong information, or more seriously information that might ...
user avatar
  • 129
11 votes
0 answers
190 views

The mobile app shows too informative login error messages

Today when I was moving to a new Android phone, I have noticed that when I typed my account password incorrectly, the message I have received was "Error while attempting to login: Bad password". Out ...
user avatar
  • 219
24 votes
2 answers
235 views

A suggested edit cuts out allegedly malicious links. How do I safely check that claim and what review action do I take?

I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the ...
user avatar
  • 14.7k
-1 votes
1 answer
385 views

Possible to vote to close for old, decommissioned close reasons (with proof of concept)

tl;dr install this user script, and it becomes possible to vote to close for old close reasons such as "not constructive" and "too localized". After doing some twiddling with Stack Exchange ...
user avatar
4 votes
1 answer
68 views

URLs for deleted questions get SEO'd automatically - is this a security issue? [duplicate]

When a user visits the link of a deleted questions, he can still see the title in the address bar. For example, when I go to https://stackoverflow.com/q/1, which is a deleted question, it redirects ...
user avatar
  • 49
38 votes
1 answer
249 views

Users are able to register apps that look official (for phishing)

Recently, a user was able to register an app with the name "StackOverflow". Alarmed, I tried it myself. If you click this authorization link, you will see: ... which sure looks official. This is ...
user avatar
16 votes
1 answer
703 views

Why would StackExchange logs show me logging in *from* a stack exchange server?

Looking at my login history (at https://openid.stackexchange.com/user) I see I've logged in several times from the IP address "198.252.206.71" but according to a quick whois search, that IP belongs to ...
user avatar
2 votes
0 answers
170 views

Broken or wrong links in Security Hall of Fame

The Security Hall of Fame contains two problematic links: The link to jeremy.ca points back to Stack Overflow. The link to Russel Van Laurio facebook profile leads to 404 Page Not Found error ...
user avatar
5 votes
2 answers
116 views

Where to ask about improvements for a security scenario?

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. What is the best ...
user avatar
  • 215
15 votes
1 answer
307 views

Prevent users from sharing private keys in cryptocurrency related communities

Being an active member of the Ethereum Stack Exchange community, I stumble upon many threads started by new users containing sensitive information about their digital wallets - private keys and 12-...
user avatar
20 votes
2 answers
866 views

Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Recently Facebook was hacked with 50M accounts compromised. I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended. I'm writing in ...
user avatar
  • 769
4 votes
3 answers
252 views

Email from Stack Exchange with a Python file attached

I received an email from Stack Exchange with a Python file attached, and it seemed suspicious. I thought y'all would want to take a look. email: From: "Stack Exchange" <do-not-reply@stackexchange....
user avatar
  • 211
3 votes
1 answer
103 views

How to login to SE sites that don't support SEOpenID without giving them my SEOpenID password?

When I'm already logged into openid.stackexchange.com (aka SEOpenID) then I am able to log into stackexchange.com (aka SE) by simply clicking the button "Login with Stack Exchange". I am not asked for ...
user avatar
14 votes
0 answers
116 views

Did Stack Exchange manage to hire a Director of Information Security?

According to How is the security bug bounty program doing?, Stack Exchange is hiring a Director of Information Security. We are in the process of hiring a Director of Information Security who will ...
user avatar
  • 9,760
54 votes
1 answer
400 views

Your handling of security reports is disappointing

I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
user avatar
  • 875
13 votes
1 answer
239 views

Dealing with highly sensitive personal information in a post

Recently, I found a user had posted a complete copy of their credit card magstripe in a question on Security SE. As I did not have 2k rep on that site at the time I could not force an edit to hide the ...
user avatar
  • 345
14 votes
1 answer
223 views

How is the security bug bounty program doing?

Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...
user avatar
  • 875
18 votes
1 answer
262 views

I reported a security issue but didn't hear back

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
user avatar
  • 875
4 votes
0 answers
54 views

Subscription removal susceptible to CSRF attacks?

It seems to me that the subscriptions tab in the profile settings page is susceptible to CSRF attacks since the links to remove yourself from subscriptions are just plain html links. Please correct if ...
user avatar
  • 4,177
8 votes
3 answers
225 views

Keeping answers related to security up to date

A paper was recently published partly about Stack Overflow, specifically relating to how a number of the accepted answers in relation to Java security were out of date and even dangerous given recent ...
user avatar
  • 137
239 votes
5 answers
11k views

Setting Up a HackerOne Security Bug Bounty Program

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
user avatar
  • 182k
-3 votes
2 answers
1k views

Enabling Dance Dance Authentication [closed]

So I saw the Dance Dance Authentication post: https://stackoverflow.blog/2017/03/30/stack-overflow-unveils-next-steps-computer-security, and I thought it sounded pretty cool. But, I can't figure out ...
user avatar
-17 votes
1 answer
138 views

Why hadn't SE had HTTPS for a long time?

I'm novice in security, but after reading the post Network-wide HTTPS: It's time I'm confused. As in the answer of Better HTTPS support for Stack Exchange sites, having an SSL certificate is not ...
user avatar
  • 5,789
14 votes
1 answer
193 views

Was the Stack Exchange network affected by the Cloudflare parser bug?

Cloudflare disclosed a memory leak incident in their software, which could lead to: returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies,...
user avatar

1
2 3 4 5