Questions tagged [security]
For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!
194
questions
240
votes
5answers
10k views
Setting Up a HackerOne Security Bug Bounty Program
We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
224
votes
10answers
9k views
Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?
Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this ...
118
votes
1answer
1k views
Security hole: password change dialog doesn't ask for a user's current password
NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011
What ...
112
votes
4answers
3k views
Can Stack Overflow change the password criteria?
Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria.
With a 22 random lowercase characters (entropy 119 bits), the create ...
101
votes
2answers
3k views
Is Stack Exchange safe from Heartbleed?
Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed?
Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
98
votes
6answers
3k views
Someone contacted me by email but my email is not public
Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked.
The email suggested I'll star a bug \ feature ...
97
votes
5answers
14k views
Is using Gravatar a security risk?
This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality.
There are some facts:
Gravatar's MD5 hash is an unsalted MD5 hash of an email address.
A ...
78
votes
7answers
2k views
Allowing images from external sources opens doors to serious security exploits
Note: Please see this answer for more info on how this poses a security risk.
I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can ...
61
votes
1answer
456 views
I can dispute flags without 10k rep, and so can you! [closed]
So I sent this bug report to SE by e-mail, but they told me to post it here...
It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator ...
58
votes
1answer
1k views
Should Stack Exchange be using the X-FRAME-OPTIONS header?
I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options
I'll let the Mozilla docs do most of the talking, but ...
53
votes
1answer
374 views
Your handling of security reports is disappointing
I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
51
votes
3answers
2k views
Implement the Hacker Badge
When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge.
from Stack Overflow Badge Feedback - Blog - Stack ...
44
votes
1answer
461 views
Establishing a Security Bug Bounty Programme for Stack Exchange [duplicate]
Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here.
At the moment SE has a security contact page which details how to contact SE regarding security issues, ...
41
votes
2answers
540 views
Is the Stack Overflow login secure against enumeration attacks?
I just noticed that when you
go to https://stackoverflow.com/users/login#log-in
pick "Stack Exchange"
enter any email address
submit the form without entering a password
you will get a message like "...
38
votes
1answer
228 views
Users are able to register apps that look official (for phishing)
Recently, a user was able to register an app with the name "StackOverflow".
Alarmed, I tried it myself.
If you click this authorization link, you will see:
... which sure looks official.
This is ...
37
votes
0answers
341 views
What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?
In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following
@jhpratt And you'll get one. And a lot of ...
asked Sep 13 at 21:04
jhpratt GOFUNDME RELICENSING
3,4662 gold badges9 silver badges20 bronze badges
37
votes
0answers
516 views
Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking
When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication.
This is not a full ...
36
votes
2answers
381 views
StackExchange OpenID provider should clearly use HTTPS
As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (...
33
votes
3answers
172 views
Let's show users an audit of account activity
So, someone had a bit of a startle the other day after realizing someone was trying to troll them by creating a parody profile. These shenanigans are fortunately pretty rare in that they actually turn ...
33
votes
2answers
472 views
Stack Exchange (main+chat) should block or render unprintable characters
Given that people share code on the main site and chat, it might be a good idea to either block or explicitly render control-characters and the like.
For example, if you copy the following code block ...
33
votes
4answers
269 views
Allow https on careers
At the moment careers.stackoverflow.com redirects you if you try and access it using https. It would be nice if it allowed secure connections (personally I think it should be the default) given the ...
31
votes
2answers
937 views
I'd like to see the last few IP addresses that my account was used from, please!
I think that as a matter of security (in the Firesheep age) I'd like to see the last IP address from which my account was accessed next to my name, somewhere in the top bar. I'd also ideally like a ...
29
votes
3answers
656 views
Should I report a serious security issue on meta?
Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center.
If I found a serious ...
29
votes
1answer
294 views
How is the data explorer secured?
I understand that the SQL user probably doesn't have any sort of permission to modify the database, and that very heavy caching is probably used in addition to the fact that this is on a data dump ...
29
votes
1answer
938 views
Block SE sites from bugmenot.com
http://www.bugmenot.com/view/stackoverflow.com
This is a troll heaven and there is no good reason for using a shared account from bugmenot on Stack Overflow or any other SE site.
Blocking a site can ...
28
votes
3answers
377 views
How to handle possible user tracking through images?
I have come across a site-meta question that ended up on the Hot Meta Posts side bar. At the time of writing, that post has about 1000 views.
Accidentally I noticed that OP used his own server (his ...
28
votes
1answer
864 views
Two factor authentication for Stack Exchange
Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication?
I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I ...
28
votes
1answer
252 views
Questions can be made Community-Wiki by adding the right parameter when editing
See also https://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept.
It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-...
27
votes
4answers
859 views
How to deal with highly voted answers with security vulnerabilities?
There's already a question on how to deal with questions/answers with a security vulnerability. But that's not really what I'm asking.
Here's the problem. There's a post in PHP that is highly upvoted ...
25
votes
1answer
556 views
Hijacked session: Signed in as someone else
I refreshed the SO home page and saw I was signed in as "Daniel Carvalho". I suspected an out-dated cache page, so I refreshed the page, but it persisted. I was able to view Daniel's user profile and ...
23
votes
1answer
251 views
How did TIBCO / Marketo obtain my Stack Exchange profile e-mail address for spamming?
My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not ...
23
votes
2answers
219 views
A suggested edit cuts out allegedly malicious links. How do I safely check that claim and what review action do I take?
I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the ...
22
votes
1answer
294 views
Improve SE OpenID logout security and user experience on shared or public machines
In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and ...
22
votes
0answers
310 views
When is the violation of OpenID 11.5.2 going to be fixed?
The Open ID spec requires that relying parties differentiate between HTTP and HTTPS URLs:
11.5.2. HTTP and HTTPS URL Identifiers
Relying Parties MUST differentiate between URL Identifiers that ...
20
votes
2answers
450 views
Chat links expose a pretty serious JavaScript exploit
So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this
I linked ...
20
votes
3answers
328 views
Don't give away incorrect password/username info
I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me ...
19
votes
3answers
1k views
Fix the captcha to prevent bots from damaging content and annoying everyone
Don't get me wrong, my motives for this post are entirely altruistic. I enjoy StackOverflow and I want the system to be improved.
I do not like your captcha. I like reCaptcha, but I also like ...
19
votes
2answers
572 views
Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?
Recently Facebook was hacked with 50M accounts compromised.
I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended.
I'm writing ...
18
votes
1answer
174 views
Don't tell me which of my credentials is wrong
If I mistype my username or password when logging in to Stack Exchange, the red dialogue box tells me which was incorrect.
If an attacker correctly guesses an email address present in the database ...
18
votes
1answer
254 views
I reported a security issue but didn't hear back
Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
17
votes
1answer
1k views
Chrome phishing warning on main [duplicate]
I just got a Chrome phishing warning on main for https://stackoverflow.com/questions/19741991/php-mysqli-dll-warning-in-linux-server
Is it just me, Chrome screwing things up or do you people have ...
16
votes
1answer
264 views
How will Stack Exchange ensure security of adverts?
I have absolutely no problem with the principle of proper adverts (i.e. Adverts that are relevant to the audience, and only appearing in the small sidebar like existing ones etc.) however the concern ...
asked Dec 2 '16 at 13:28
Ro-Reinstate Monic-Alsop
15.4k8 gold badges34 silver badges81 bronze badges
16
votes
1answer
134 views
Possible CSRF attack that cause answers to be added to “Top Answers” section
In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta
If ...
asked Aug 19 '15 at 15:20
Shadow The Princess Wizard
137k24 gold badges314 silver badges651 bronze badges
16
votes
2answers
262 views
Is my Web Apps account under threat or am I being paranoid?
I've just checked my IP addresses on Web Apps (Link for Web Apps mods and developers):
https://webapps.stackexchange.com/admin/show-user-ips/21
and a couple show up as being used once but the weird ...
15
votes
4answers
409 views
Vote to emergency suspend for three 5k+ or 10k+ users?
There was a case a few days back of a user going crazy and starting edit wars in all of his 42 questions, resulting in 50-100 new revisions per question. It being the weekend, it took 1-2 hours until ...
asked Jan 23 '11 at 14:21
Pekka supports GoFundMonica
98.7k65 gold badges368 silver badges617 bronze badges
15
votes
2answers
220 views
weak sign up page password placeholder text
According to this article the password 12345 was the third most popular password in use in the year of 2014. So why does SE use such a weak and commonly used password as a placeholder hint?
...
15
votes
3answers
507 views
Is SOFU prepared for a DDoS attack?
I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would ...
14
votes
4answers
948 views
Could Stack Overflow be damaged by “URL poisoning”?
This might not be a big problem, but say the following URL is a good Stack Overflow question:
https://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer
Try this. Open a ...
14
votes
1answer
187 views
Was the Stack Exchange network affected by the Cloudflare parser bug?
Cloudflare disclosed a memory leak incident in their software, which could lead to:
returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies,...
14
votes
1answer
203 views
How is the security bug bounty program doing?
Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...
