Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

24 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
37
votes
0answers
341 views

What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?

In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following @jhpratt And you'll get one. And a lot of ...
37
votes
0answers
516 views

Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking

When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication. This is not a full ...
22
votes
0answers
310 views

When is the violation of OpenID 11.5.2 going to be fixed?

The Open ID spec requires that relying parties differentiate between HTTP and HTTPS URLs: 11.5.2. HTTP and HTTPS URL Identifiers Relying Parties MUST differentiate between URL Identifiers that ...
12
votes
0answers
107 views

Did Stack Exchange manage to hire a Director of Information Security?

According to How is the security bug bounty program doing?, Stack Exchange is hiring a Director of Information Security. We are in the process of hiring a Director of Information Security who will ...
11
votes
0answers
112 views

The mobile app shows too informative login error messages

Today when I was moving to a new Android phone, I have noticed that when I typed my account password incorrectly, the message I have received was "Error while attempting to login: Bad password". Out ...
10
votes
0answers
45 views

Add a 'I have found a security-related issue' line to the reasons combobox in the 'Contact us' form

Related: Should I report a serious security issue on meta? How do I report a possible security vulnerability? Rationale: discoverability without having to jump through several hoops. Side note: ...
10
votes
0answers
423 views

SSL certificate OCSP verification issue on cdn.sstatic.net, SO's JS/CSS not loading

Since the beginning of July I have intermittent trouble loading SO because I randomly can't verify the CDN's SSL certificate through OCSP. Network connectivity is otherwise good (traceroute & ping ...
8
votes
0answers
91 views

Time to upgrade SSL Cert(s) on *stackexchange.com

When browsing any StackExchange site, my Firefox console displays this warning: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use ...
7
votes
0answers
215 views

Login problem on: Firefox → math.stackexchange.com

I'm now using Firefox 31. I'm connected on many stackexchange web servers with the same login method. Unfortunately I can't connect within the exact same session, with the same browser, and with the ...
5
votes
0answers
100 views

Enable Content Security Policy on Stack Exchange

I think it would be a good idea to enable Content Security Policy on Stack Exchange. With CSP it's possible to disable inline scripts, and that can improve security. For example, some time ago I ...
5
votes
0answers
49 views

Opt-out of being logged-in without SSL

For me at least, partial SSL support with mixed content has been working for a long time. I'm aware that the SSL rollout is a slow process, but whenever I'm connected without an ‘s’ after the ‘http’, ...
5
votes
0answers
56 views

Points, tags and overlap

I noticed that there's a .net-4 tag with very little usage (2) and decided to suggest it should be rolled into the .net-4.0 tag. Needless to say I have no points in this tag. As the .net-4.0 is used ...
5
votes
1answer
105 views

How many user accounts on SE sites get hacked per year?

I've run a few queries for users with spam penalties across SE sites (SEDE link) and it occurred to me that there may be some accounts that were hacked into and used for posting spam. While this is ...
4
votes
0answers
51 views

Subscription removal susceptible to CSRF attacks?

It seems to me that the subscriptions tab in the profile settings page is susceptible to CSRF attacks since the links to remove yourself from subscriptions are just plain html links. Please correct if ...
4
votes
0answers
138 views

If anybody can upload image to Stack Exchange imgur accout, why do we send fkey?

I was developing userscript that uploads files to Stack Exchange Imgur app account. What I discovered during development can be seen here. The thing is that according to my test, any program can add ...
3
votes
0answers
130 views

McAfee SiteAdvisor has a false positive on certain skeptics.SE questions

McAfee SiteAdvisor seems to suggest that this question on skeptics.SE is a security risk, and them it nags me that there is a risk. This happens for several other questions as well. The site report ...
3
votes
0answers
219 views

logging in via Google not working under firefox - security error

I've tried to log in to this site via Google since I've been doing so for other StackExchange sites for a while now. However, it isn't working. When I click the "Log in using Google" link, it doesn't ...
3
votes
0answers
173 views

Should Stack Exchange log out all users from the network and let them sign in again in the wake of the Heartbleed vulnerability?

I see that over the past few days the hype for "Heartbleed Security Vulnerability" has increased. Several sites administrators have take actions to prevent their servers from being compromised. ...
2
votes
0answers
143 views

Broken or wrong links in Security Hall of Fame

The Security Hall of Fame contains two problematic links: The link to jeremy.ca points back to Stack Overflow. The link to Russel Van Laurio facebook profile leads to 404 Page Not Found error ...
2
votes
0answers
137 views

Allow framing of links to current site in stack snippets

Over at PPCG.SE (CodeGolf.SE), we regularly use stack snippets for leaderboards for our programming challenges. However, the snippets feature prevents our leaderboards from having links to the answers....
2
votes
0answers
96 views

The new login process

I see the login page recently got an upgrade and the site started supporting https. First off: That's great! I've been waiting for this for years. Unfortunately it also came with some issues. Old ...
1
vote
0answers
57 views

Is it possible to have a login which isn’t an E-mail?

I would like to be able to manage my accounts (private information) independently of my e-mails (public information) because: I would like to avoid any sharing of accounts between different servers, ...
1
vote
0answers
52 views

Validate when account email is changed

Please consider validating the email when it is change in the user account. Similar to the "Registration Account Email Validation". I believe that if someone hacks your account and try to change the ...
0
votes
0answers
84 views

Universal sign-in and session

The user's session should be persistent between all sites. Signing in to meta.stackexchange.com, then navigating to wordpress.stackexchange.com should not ask the user for credentials a second time. ...