Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
-19
votes
2answers
236 views

Prefer only 'they' for personal pronouns due to privacy and security

This is specifically regarding updates to the new CoC (Official FAQ on gender pronouns and Code of Conduct changes) addressing personal pronouns. The point, up front With Internet hackers, bots, and ...
30
votes
0answers
294 views

What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?

In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following @jhpratt And you'll get one. And a lot of ...
78
votes
7answers
2k views

Allowing images from external sources opens doors to serious security exploits

Note: Please see this answer for more info on how this poses a security risk. I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can ...
2
votes
0answers
51 views

How to change my login and login provider [duplicate]

I have been using an authentication through my Gmail account because many years ago I thought it was a good method from a security standpoint, (even if the fact to use an E-mail as an account is a ...
-21
votes
1answer
116 views

Stack Exchange Security vs. Online Forums [closed]

How secure is Stack Exchange compared to online forums such as Reddit or Quora? Better? Worse? How difficult is it to hack and how secure is user information?
1
vote
0answers
56 views

Is it possible to have a login which isn’t an E-mail?

I would like to be able to manage my accounts (private information) independently of my e-mails (public information) because: I would like to avoid any sharing of accounts between different servers, ...
1
vote
0answers
63 views

Getting attention for answers that have aways been incorrect [duplicate]

There's a question about what to do about outdated answers, but what if the answer is not outdated but was always incorrect and gave simply wrong information, or more seriously information that might ...
10
votes
0answers
100 views

The mobile app shows too informative login error messages

Today when I was moving to a new Android phone, I have noticed that when I typed my account password incorrectly, the message I have received was "Error while attempting to login: Bad password". Out ...
-1
votes
1answer
339 views

Possible to vote to close for old, decommissioned close reasons (with proof of concept)

tl;dr install this user script, and it becomes possible to vote to close for old close reasons such as "not constructive" and "too localized". After doing some twiddling with Stack Exchange ...
23
votes
2answers
218 views

A suggested edit cuts out allegedly malicious links. How do I safely check that claim and what review action do I take?

I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the ...
4
votes
1answer
56 views

URLs for deleted questions get SEO'd automatically - is this a security issue? [duplicate]

When a user visits the link of a deleted questions, he can still see the title in the address bar. For example, when I go to https://stackoverflow.com/q/1, which is a deleted question, it redirects ...
38
votes
1answer
225 views

Users are able to register apps that look official (for phishing)

Recently, a user was able to register an app with the name "StackOverflow". Alarmed, I tried it myself. If you click this authorization link, you will see: ... which sure looks official. This is ...
10
votes
1answer
272 views

Why would StackExchange logs show me logging in *from* a stack exchange server?

Looking at my login history (at https://openid.stackexchange.com/user) I see I've logged in several times from the IP address "198.252.206.71" but according to a quick whois search, that IP belongs to ...
2
votes
0answers
142 views

Broken or wrong links in Security Hall of Fame

The Security Hall of Fame contains two problematic links: The link to jeremy.ca points back to Stack Overflow. The link to Russel Van Laurio facebook profile leads to 404 Page Not Found error ...
4
votes
2answers
105 views

Where to ask about improvements for a security scenario?

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. What is the best ...
2
votes
1answer
92 views

How to login to SE sites that don't support SEOpenID without giving them my SEOpenID password?

When I'm already logged into openid.stackexchange.com (aka SEOpenID) then I am able to log into stackexchange.com (aka SE) by simply clicking the button "Login with Stack Exchange". I am not asked for ...
11
votes
1answer
120 views

Prevent users from sharing private keys in cryptocurrency related communities

Being an active member of the Ethereum Stack Exchange community, I stumble upon many threads started by new users containing sensitive information about their digital wallets - private keys and 12-...
51
votes
3answers
2k views

Implement the Hacker Badge

When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge. from Stack Overflow Badge Feedback - Blog - Stack ...
53
votes
1answer
372 views

Your handling of security reports is disappointing

I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
18
votes
2answers
532 views

Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Recently Facebook was hacked with 50M accounts compromised. I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended. I'm writing ...
8
votes
1answer
51 views

Make information on own login history and other sessions visible to user

I think that a really important security feature, which SE lacks, is that there is no login history. Well, at least, it is not displayed to normal users about their accounts and only to moderators. ...
4
votes
3answers
189 views

Email from Stack Exchange with a Python file attached

I received an email from Stack Exchange with a Python file attached, and it seemed suspicious. I thought y'all would want to take a look. email: From: "Stack Exchange" <do-not-reply@stackexchange....
11
votes
0answers
104 views

Did Stack Exchange manage to hire a Director of Information Security?

According to How is the security bug bounty program doing?, Stack Exchange is hiring a Director of Information Security. We are in the process of hiring a Director of Information Security who will ...
12
votes
1answer
212 views

Dealing with highly sensitive personal information in a post

Recently, I found a user had posted a complete copy of their credit card magstripe in a question on Security SE. As I did not have 2k rep on that site at the time I could not force an edit to hide the ...
14
votes
1answer
199 views

How is the security bug bounty program doing?

Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...
-2
votes
1answer
269 views

Able to view any deleted or private chat message, with 20 rep

Normally, if you try to view a deleted message or a message from a private room, you will not be able to view its content. Deleted messages show as "(deleted)" in the room itself, are absent from the ...
1
vote
1answer
1k views

Why am I getting a security warning from Chrome browser when navigating to StackOverflow? [duplicate]

Possible Duplicate: Better HTTPS support for Stack Exchange sites Google Chrome warning of an SSL problem with Stack Overflow I tried to navigate to this Stack Overflow answer Hash algorithms - ...
33
votes
2answers
467 views

Stack Exchange (main+chat) should block or render unprintable characters

Given that people share code on the main site and chat, it might be a good idea to either block or explicitly render control-characters and the like. For example, if you copy the following code block ...
7
votes
3answers
425 views

Is it a problem that 10% of SO emails tried were guessed by using the username and Gravatar account?

A recent Slashdot article speaks about how somebody was able to discover the email addresses of 10% of SO users through the username and Gravatar system. http://tech.slashdot.org/story/09/12/15/...
18
votes
1answer
254 views

I reported a security issue but didn't hear back

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
8
votes
3answers
213 views

Keeping answers related to security up to date

A paper was recently published partly about Stack Overflow, specifically relating to how a number of the accepted answers in relation to Java security were out of date and even dangerous given recent ...
4
votes
0answers
51 views

Subscription removal susceptible to CSRF attacks?

It seems to me that the subscriptions tab in the profile settings page is susceptible to CSRF attacks since the links to remove yourself from subscriptions are just plain html links. Please correct if ...
224
votes
10answers
9k views

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this ...
112
votes
4answers
3k views

Can Stack Overflow change the password criteria?

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria. With a 22 random lowercase characters (entropy 119 bits), the create ...
240
votes
5answers
10k views

Setting Up a HackerOne Security Bug Bounty Program

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
2
votes
2answers
419 views

Is Stack Overflow's (SSL) log-in process optimal from a UX perspective? [duplicate]

Does Stack Overflow use SSL when transmitting passwords during the log-in process? This question comes up when you log-on, because there is no green lock in the browser when logging in. I do use the ...
3
votes
1answer
39 views

User flair image should be served over SSL as well

Unfortunately, the current flair image is only served over plain HTTP. Naturally, if you embed it directly on a page served over SSL, you will get mixed content warning from your browser. Please ...
5
votes
0answers
49 views

Opt-out of being logged-in without SSL

For me at least, partial SSL support with mixed content has been working for a long time. I'm aware that the SSL rollout is a slow process, but whenever I'm connected without an ‘s’ after the ‘http’, ...
3
votes
0answers
34 views

Bad SSL/TLS at Stack Exchange: Cloudflares SSL certificates and sometimes no HTTPS at all [duplicate]

Cloudflare Cloudflare has the options Universal/Flexible SSL, which basically allow websites to serve their website over HTTPS by using a certificate from Cloudflare. Besides the fact that ...
33
votes
4answers
269 views

Allow https on careers

At the moment careers.stackoverflow.com redirects you if you try and access it using https. It would be nice if it allowed secure connections (personally I think it should be the default) given the ...
-3
votes
2answers
1k views

Enabling Dance Dance Authentication [closed]

So I saw the Dance Dance Authentication post: https://stackoverflow.blog/2017/03/30/stack-overflow-unveils-next-steps-computer-security, and I thought it sounded pretty cool. But, I can't figure out ...
-16
votes
1answer
125 views

Why hadn't SE had HTTPS for a long time?

I'm novice in security, but after reading the post Network-wide HTTPS: It's time I'm confused. As in the answer of Better HTTPS support for Stack Exchange sites, having an SSL certificate is not ...
37
votes
0answers
513 views

Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking

When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication. This is not a full ...
14
votes
1answer
186 views

Was the Stack Exchange network affected by the Cloudflare parser bug?

Cloudflare disclosed a memory leak incident in their software, which could lead to: returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies,...
11
votes
4answers
1k views

Is there a stack site for home automation / home security?

Perused the list, used search, and yet a home automation and/or home security site doesn’t seem to be available. Seems like something a bunch of techie types would want to share info about. Is it ...
-6
votes
1answer
151 views

“this user prefers to keep an air of mystery about them” - can this wording be changed?

I'm posting this question anonymously for obvious reasons. It should be on meta, but I can't post there anonymously. It would be great if someone would move it there. The new head of the Department ...
2
votes
0answers
34 views

Why does this site not require login after new browser session? [duplicate]

To clarify: I've set this site to not remember me. This seems to be ambiguous on different sites now as that can either mean to not keep track of my credentials locally and to keep me logged in or to ...
23
votes
1answer
246 views

How did TIBCO / Marketo obtain my Stack Exchange profile e-mail address for spamming?

My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not ...
16
votes
1answer
263 views

How will Stack Exchange ensure security of adverts?

I have absolutely no problem with the principle of proper adverts (i.e. Adverts that are relevant to the audience, and only appearing in the small sidebar like existing ones etc.) however the concern ...
5
votes
0answers
99 views

Enable Content Security Policy on Stack Exchange

I think it would be a good idea to enable Content Security Policy on Stack Exchange. With CSP it's possible to disable inline scripts, and that can improve security. For example, some time ago I ...