Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
240
votes
5answers
10k views

Setting Up a HackerOne Security Bug Bounty Program

We at Stack Overflow are interested in setting up a security bug bounty program to begin rewarding users monetarily who report serious security vulnerabilities to us, and we want to know what the ...
224
votes
10answers
9k views

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this ...
118
votes
1answer
1k views

Security hole: password change dialog doesn't ask for a user's current password

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011 What ...
112
votes
4answers
3k views

Can Stack Overflow change the password criteria?

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria. With a 22 random lowercase characters (entropy 119 bits), the create ...
101
votes
2answers
3k views

Is Stack Exchange safe from Heartbleed?

Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed? Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
98
votes
6answers
3k views

Someone contacted me by email but my email is not public

Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked. The email suggested I'll star a bug \ feature ...
97
votes
5answers
14k views

Is using Gravatar a security risk?

This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality. There are some facts: Gravatar's MD5 hash is an unsalted MD5 hash of an email address. A ...
78
votes
7answers
2k views

Allowing images from external sources opens doors to serious security exploits

Note: Please see this answer for more info on how this poses a security risk. I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can ...
61
votes
1answer
456 views

I can dispute flags without 10k rep, and so can you! [closed]

So I sent this bug report to SE by e-mail, but they told me to post it here... It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator ...
58
votes
1answer
1k views

Should Stack Exchange be using the X-FRAME-OPTIONS header?

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options I'll let the Mozilla docs do most of the talking, but ...
53
votes
1answer
374 views

Your handling of security reports is disappointing

I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates ...
51
votes
3answers
2k views

Implement the Hacker Badge

When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge. from Stack Overflow Badge Feedback - Blog - Stack ...
44
votes
1answer
461 views

Establishing a Security Bug Bounty Programme for Stack Exchange [duplicate]

Following on from a conversation with @shog9 on the DMZ, it was suggested to raise this here. At the moment SE has a security contact page which details how to contact SE regarding security issues, ...
41
votes
2answers
540 views

Is the Stack Overflow login secure against enumeration attacks?

I just noticed that when you go to https://stackoverflow.com/users/login#log-in pick "Stack Exchange" enter any email address submit the form without entering a password you will get a message like "...
38
votes
1answer
228 views

Users are able to register apps that look official (for phishing)

Recently, a user was able to register an app with the name "StackOverflow". Alarmed, I tried it myself. If you click this authorization link, you will see: ... which sure looks official. This is ...
37
votes
0answers
341 views

What is the status of the secure electronic opt-out of the mandatory arbitration that was promised?

In the comments of this post, Tim Post responds to my request for a "secure, electronic means" of the opt-out of mandatory arbitration with the following @jhpratt And you'll get one. And a lot of ...
37
votes
0answers
516 views

Logins can be added/removed without reauthenticating, allowing temporary XSS to be escalated to permanent account hijacking

When you're logged in to a Stack Exchange account, it's possible to add and remove logins (associated OpenID/OAuth accounts) without performing any form of reauthentication. This is not a full ...
36
votes
2answers
381 views

StackExchange OpenID provider should clearly use HTTPS

As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (...
33
votes
3answers
172 views

Let's show users an audit of account activity

So, someone had a bit of a startle the other day after realizing someone was trying to troll them by creating a parody profile. These shenanigans are fortunately pretty rare in that they actually turn ...
33
votes
2answers
472 views

Stack Exchange (main+chat) should block or render unprintable characters

Given that people share code on the main site and chat, it might be a good idea to either block or explicitly render control-characters and the like. For example, if you copy the following code block ...
33
votes
4answers
269 views

Allow https on careers

At the moment careers.stackoverflow.com redirects you if you try and access it using https. It would be nice if it allowed secure connections (personally I think it should be the default) given the ...
31
votes
2answers
937 views

I'd like to see the last few IP addresses that my account was used from, please!

I think that as a matter of security (in the Firesheep age) I'd like to see the last IP address from which my account was accessed next to my name, somewhere in the top bar. I'd also ideally like a ...
29
votes
3answers
656 views

Should I report a serious security issue on meta?

Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center. If I found a serious ...
29
votes
1answer
294 views

How is the data explorer secured?

I understand that the SQL user probably doesn't have any sort of permission to modify the database, and that very heavy caching is probably used in addition to the fact that this is on a data dump ...
29
votes
1answer
938 views

Block SE sites from bugmenot.com

http://www.bugmenot.com/view/stackoverflow.com This is a troll heaven and there is no good reason for using a shared account from bugmenot on Stack Overflow or any other SE site. Blocking a site can ...
28
votes
3answers
377 views

How to handle possible user tracking through images?

I have come across a site-meta question that ended up on the Hot Meta Posts side bar. At the time of writing, that post has about 1000 views. Accidentally I noticed that OP used his own server (his ...
28
votes
1answer
864 views

Two factor authentication for Stack Exchange

Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication? I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I ...
28
votes
1answer
252 views

Questions can be made Community-Wiki by adding the right parameter when editing

See also https://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept. It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-...
27
votes
4answers
859 views

How to deal with highly voted answers with security vulnerabilities?

There's already a question on how to deal with questions/answers with a security vulnerability. But that's not really what I'm asking. Here's the problem. There's a post in PHP that is highly upvoted ...
25
votes
1answer
556 views

Hijacked session: Signed in as someone else

I refreshed the SO home page and saw I was signed in as "Daniel Carvalho". I suspected an out-dated cache page, so I refreshed the page, but it persisted. I was able to view Daniel's user profile and ...
23
votes
1answer
251 views

How did TIBCO / Marketo obtain my Stack Exchange profile e-mail address for spamming?

My Stack Exchange profile has a specific e-mail address that I use on no other Internet site, and should be unguessable. My Developer Story is set to private. My profile has an uploaded image, not ...
23
votes
2answers
219 views

A suggested edit cuts out allegedly malicious links. How do I safely check that claim and what review action do I take?

I came across this suggested edit on Movies.SE this morning. The edit cut out two shortened links (TinyUrl), claiming they linked to a virus, and added a disclaimer not to click said links in the ...
22
votes
1answer
294 views

Improve SE OpenID logout security and user experience on shared or public machines

In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and ...
22
votes
0answers
310 views

When is the violation of OpenID 11.5.2 going to be fixed?

The Open ID spec requires that relying parties differentiate between HTTP and HTTPS URLs: 11.5.2. HTTP and HTTPS URL Identifiers Relying Parties MUST differentiate between URL Identifiers that ...
20
votes
2answers
450 views

Chat links expose a pretty serious JavaScript exploit

So I learned something rather surprising today and it's pretty scary. I'm actually stunned neither Chrome/Google, nor Mozilla, have plugged it. First, the logistics of how I ran across this I linked ...
20
votes
3answers
328 views

Don't give away incorrect password/username info

I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me ...
19
votes
3answers
1k views

Fix the captcha to prevent bots from damaging content and annoying everyone

Don't get me wrong, my motives for this post are entirely altruistic. I enjoy StackOverflow and I want the system to be improved. I do not like your captcha. I like reCaptcha, but I also like ...
19
votes
2answers
572 views

Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Recently Facebook was hacked with 50M accounts compromised. I just got a message from a moderator of Stack Exchange site Information Security that my account has been suspended. I'm writing ...
18
votes
1answer
174 views

Don't tell me which of my credentials is wrong

If I mistype my username or password when logging in to Stack Exchange, the red dialogue box tells me which was incorrect. If an attacker correctly guesses an email address present in the database ...
18
votes
1answer
254 views

I reported a security issue but didn't hear back

Ten days ago, I reported a cross-site scripting bug on a stackexchange.com subdomain, and two days ago, I inquired if my report was received and whether I could help with further information. But so ...
17
votes
1answer
1k views

Chrome phishing warning on main [duplicate]

I just got a Chrome phishing warning on main for https://stackoverflow.com/questions/19741991/php-mysqli-dll-warning-in-linux-server Is it just me, Chrome screwing things up or do you people have ...
16
votes
1answer
264 views

How will Stack Exchange ensure security of adverts?

I have absolutely no problem with the principle of proper adverts (i.e. Adverts that are relevant to the audience, and only appearing in the small sidebar like existing ones etc.) however the concern ...
16
votes
1answer
134 views

Possible CSRF attack that cause answers to be added to “Top Answers” section

In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta If ...
16
votes
2answers
262 views

Is my Web Apps account under threat or am I being paranoid?

I've just checked my IP addresses on Web Apps (Link for Web Apps mods and developers): https://webapps.stackexchange.com/admin/show-user-ips/21 and a couple show up as being used once but the weird ...
15
votes
4answers
409 views

Vote to emergency suspend for three 5k+ or 10k+ users?

There was a case a few days back of a user going crazy and starting edit wars in all of his 42 questions, resulting in 50-100 new revisions per question. It being the weekend, it took 1-2 hours until ...
15
votes
2answers
220 views

weak sign up page password placeholder text

According to this article the password 12345 was the third most popular password in use in the year of 2014. So why does SE use such a weak and commonly used password as a placeholder hint? ...
15
votes
3answers
507 views

Is SOFU prepared for a DDoS attack?

I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would ...
14
votes
4answers
948 views

Could Stack Overflow be damaged by “URL poisoning”?

This might not be a big problem, but say the following URL is a good Stack Overflow question: https://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer Try this. Open a ...
14
votes
1answer
187 views

Was the Stack Exchange network affected by the Cloudflare parser bug?

Cloudflare disclosed a memory leak incident in their software, which could lead to: returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies,...
14
votes
1answer
203 views

How is the security bug bounty program doing?

Last year, SE announced setting up a HackerOne Security Bug Bounty Program in private beta mode, which has received tons of positive feedback. Since then, it seems there haven't been any public ...