Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
224
votes
10answers
9k views

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this ...
97
votes
5answers
14k views

Is using Gravatar a security risk?

This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality. There are some facts: Gravatar's MD5 hash is an unsalted MD5 hash of an email address. A ...
25
votes
1answer
554 views

Hijacked session: Signed in as someone else

I refreshed the SO home page and saw I was signed in as "Daniel Carvalho". I suspected an out-dated cache page, so I refreshed the page, but it persisted. I was able to view Daniel's user profile and ...
11
votes
1answer
202 views

Data is showing MvcMiniProfiler results. Is that expected?

Not sure if this is actually desired, but data is currently showing me (a SE non-dev) mvc-mini-profiler results, including all queries that are being run against the DB (not talking about data-...
98
votes
6answers
3k views

Someone contacted me by email but my email is not public

Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked. The email suggested I'll star a bug \ feature ...
112
votes
4answers
3k views

Can Stack Overflow change the password criteria?

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria. With a 22 random lowercase characters (entropy 119 bits), the create ...
22
votes
1answer
294 views

Improve SE OpenID logout security and user experience on shared or public machines

In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and ...
19
votes
3answers
1k views

Fix the captcha to prevent bots from damaging content and annoying everyone

Don't get me wrong, my motives for this post are entirely altruistic. I enjoy StackOverflow and I want the system to be improved. I do not like your captcha. I like reCaptcha, but I also like ...
78
votes
7answers
2k views

Allowing images from external sources opens doors to serious security exploits

Note: Please see this answer for more info on how this poses a security risk. I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can ...
11
votes
1answer
2k views

How does Stack Overflow protect its sitemap?

The purpose of this question is not to find out how SO protects its sitemap in order to subvert it, so to that end, I don't expect an exact answer. However, questions around SO's sitemap have popped ...
61
votes
1answer
456 views

I can dispute flags without 10k rep, and so can you! [closed]

So I sent this bug report to SE by e-mail, but they told me to post it here... It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator ...
29
votes
3answers
653 views

Should I report a serious security issue on meta?

Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center. If I found a serious ...
14
votes
4answers
940 views

Could Stack Overflow be damaged by “URL poisoning”?

This might not be a big problem, but say the following URL is a good Stack Overflow question: https://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer Try this. Open a ...
101
votes
2answers
3k views

Is Stack Exchange safe from Heartbleed?

Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed? Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
119
votes
1answer
1k views

Security hole: password change dialog doesn't ask for a user's current password

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011 What ...
37
votes
0answers
513 views

Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking

When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication. This is not a full ...
27
votes
4answers
846 views

How to deal with highly voted answers with security vulnerabilities?

There's already a question on how to deal with questions/answers with a security vulnerability. But that's not really what I'm asking. Here's the problem. There's a post in PHP that is highly upvoted ...
58
votes
1answer
1k views

Should Stack Exchange be using the X-FRAME-OPTIONS header?

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options I'll let the Mozilla docs do most of the talking, but ...
-19
votes
2answers
236 views

Prefer only 'they' for personal pronouns due to privacy and security

This is specifically regarding updates to the new CoC (Official FAQ on gender pronouns and Code of Conduct changes) addressing personal pronouns. The point, up front With Internet hackers, bots, and ...
240
votes
5answers
10k views

Setting Up a HackerOne Security Bug Bounty Program

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
44
votes
1answer
458 views

Establishing a Security Bug Bounty Programme for Stack Exchange [duplicate]

Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here. At the moment SE has a security contact page which details how to contact SE regarding security issues, ...
51
votes
3answers
2k views

Implement the Hacker Badge

When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge. from Stack Overflow Badge Feedback - Blog - Stack ...
26
votes
1answer
815 views

Two factor authentication for Stack Exchange

Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication? I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I ...
13
votes
7answers
690 views

Is it okay to discuss poor security practices?

I have experienced people actively hindering or flaming people who want to make public or discuss techniques that can break good security habits or schemes of languages, software or operating systems. ...
9
votes
0answers
201 views

AVG 10 free detects “Input validation exploit” [duplicate]

Possible Duplicate: What's this virus threat on Google Chrome when editing a Stack Overflow post? I just got this while my computer was idling: Danger: Surf-Shield has detected active ...
13
votes
1answer
472 views

Question on SE site being reported as a phishing site?

See this question on Meta Security SE: security se reported by chrome as a suspected phishing site They mention this question on Security SE: Is the Facebook login form using SSL without https in the ...
2
votes
2answers
419 views

Is Stack Overflow's (SSL) log-in process optimal from a UX perspective? [duplicate]

Does Stack Overflow use SSL when transmitting passwords during the log-in process? This question comes up when you log-on, because there is no green lock in the browser when logging in. I do use the ...
28
votes
3answers
370 views

How to handle possible user tracking through images?

I have come across a site-meta question that ended up on the Hot Meta Posts side bar. At the time of writing, that post has about 1000 views. Accidentally I noticed that OP used his own server (his ...
19
votes
2answers
439 views

Chat links expose a pretty serious JavaScript exploit

So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this I linked ...
29
votes
1answer
294 views

How is the data explorer secured?

I understand that the SQL user probably doesn't have any sort of permission to modify the database, and that very heavy caching is probably used in addition to the fact that this is on a data dump ...
28
votes
1answer
252 views

Questions can be made Community-Wiki by adding the right parameter when editing

See also https://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept. It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-...
8
votes
1answer
370 views

If an account gets hijacked and used for posting illegal material, will Stack Exchange be willing to cooperate with local attorneys?

It makes several years that this post is status-planned. There are reason to consider it won’t be status-completed in the upcoming years. So whatever I can do, my account can be hijacked anytime ...
17
votes
1answer
1k views

Chrome phishing warning on main [duplicate]

I just got a Chrome phishing warning on main for https://stackoverflow.com/questions/19741991/php-mysqli-dll-warning-in-linux-server Is it just me, Chrome screwing things up or do you people have ...
10
votes
1answer
272 views

Why would StackExchange logs show me logging in *from* a stack exchange server?

Looking at my login history (at https://openid.stackexchange.com/user) I see I've logged in several times from the IP address "198.252.206.71" but according to a quick whois search, that IP belongs to ...
1
vote
2answers
373 views

What's this virus threat on Google Chrome when editing a Stack Overflow post?

When editing my previous post I got this: How does it come? It seems it only occurs on this particular post, Running Exe in Firefox why do I get an error, not on the one I am writing here for example....
12
votes
1answer
222 views

How does StackExchange DataExplorer prevent DOS attacks?

I have seen the page for composing Data Explorer queries. If I enter some stupid queries like: select * from Posts a, Posts b, Posts c ..... where 1=1 etc., how does StackExchange prevent it from ...
7
votes
1answer
1k views

Should changing your password invalidate all existing logins?

Last night I changed the password for my Stack Exchange OpenID. As a security precaution, I would expect that all of my sessions be invalidated and to be asked to log in again on all sites where I use ...
3
votes
1answer
1k views

Google Shield on SO : Insecure Content

According to my other question, there appears to be a problem with Chrome and JavaScript. I'm seeing a little shield in the address-bar, meaning there's insecure content on SO. Is this a problem on ...
2
votes
1answer
78 views

Non-https links to other StackExchange sites in User profile when using https

The links to other StackExchange sites in User profile -> Summary -> Accounts don't use https when the User profile was accessed using https.
2
votes
8answers
382 views

Does your profile contain your exact birthday? Is that safe?

Does your profile contain your real birthday, or is off by +/- n days (where n is small)? I know the birthday isn't explicitly available to users, but as suggested by this post, it would be easy to ...
-1
votes
1answer
160 views

Is it possible to effectively control spamming or other undesirable behavior without relying on security through obscurity?

This is meant to replace a question I ended up deleting regarding the advantages of displaying a haiku rather than a clearer message on spam detection for unregistered users (link for 10k users). ...
36
votes
2answers
381 views

StackExchange OpenID provider should clearly use HTTPS

As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (...
33
votes
2answers
467 views

Stack Exchange (main+chat) should block or render unprintable characters

Given that people share code on the main site and chat, it might be a good idea to either block or explicitly render control-characters and the like. For example, if you copy the following code block ...
8
votes
2answers
1k views

Why are Stack Exchange password requirements so strict? [duplicate]

I apologize for this off-topic post, but I hope it will be read by as many moderators as possible: I just wanted to register on Stack Overflow, to be able to leave ratings, etc. I didn't end up ...
22
votes
0answers
309 views

When is the violation of OpenID 11.5.2 going to be fixed?

The Open ID spec requires that relying parties differentiate between HTTP and HTTPS URLs: 11.5.2. HTTP and HTTPS URL Identifiers Relying Parties MUST differentiate between URL Identifiers that ...
18
votes
1answer
254 views

I reported a security issue but didn't hear back

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
6
votes
2answers
219 views

How to deal with questions/answers with a security vulnerability?

Sine a major goal of SO is to compile the best programming questions and answers on the internet, I'm wondering if there's more we can do to single out and/or correct cases where questions or answers ...
31
votes
2answers
933 views

I'd like to see the last few IP addresses that my account was used from, please!

I think that as a matter of security (in the Firesheep age) I'd like to see the last IP address from which my account was accessed next to my name, somewhere in the top bar. I'd also ideally like a ...
14
votes
1answer
199 views

How is the security bug bounty program doing?

Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...
12
votes
1answer
584 views

Do Stack Exchange sites have any sort of security bug bounty program? [duplicate]

Not that I have been looking for security issues or anything. I am just curious if they have a policy regarding people searching for and reporting potential security issues?