Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
6
votes
0answers
41 views

It would have been nice to know that shared links include my user id [duplicate]

I noticed that every short-link/permalink that I share while I'm logged in includes my user id. It would have been really nice if the UI had highlighted this fact in the link sharing popup so that ...
3
votes
0answers
34 views

Bad SSL/TLS at Stack Exchange: Cloudflares SSL certificates and sometimes no HTTPS at all [duplicate]

Cloudflare Cloudflare has the options Universal/Flexible SSL, which basically allow websites to serve their website over HTTPS by using a certificate from Cloudflare. Besides the fact that ...
4
votes
2answers
53 views

How does Stack Exchange prevent all its contents from being stolen through its API?

There's something I have hard time to understand with this world of APIs: when you have your WebApp/MobileApp ecosystem entirely based on an API giving access to your database, how do you prevent all ...
2
votes
0answers
137 views

Allow framing of links to current site in stack snippets

Over at PPCG.SE (CodeGolf.SE), we regularly use stack snippets for leaderboards for our programming challenges. However, the snippets feature prevents our leaderboards from having links to the answers....
8
votes
1answer
51 views

Make information on own login history and other sessions visible to user

I think that a really important security feature, which SE lacks, is that there is no login history. Well, at least, it is not displayed to normal users about their accounts and only to moderators. ...
-2
votes
2answers
87 views

How to escape cyberstalking without losing points and reputation?

Suppose someone is cyberstalking me on Stack Exchange. They could gain quite a lot of insight on what I am doing by simply reading my posts. I could create a new account, but that would mean losing ...
0
votes
0answers
42 views

“funmontage” is not fun, was this clone/impersonator of all SE detected before? [duplicate]

I noticed that all sites of stackexchange were replicated in detail with "funmontage.com" (all internal links are pointing to their own domain, even signup and login pages). Here are some examples: ...
16
votes
1answer
134 views

Possible CSRF attack that cause answers to be added to “Top Answers” section

In Careers, adding answers to the "Top Answers" section of the profile is done via a pure GET request, e.g. http://careers.stackoverflow.com/cv/stack/add-answer/45190?answerId=227366&site=meta If ...
15
votes
2answers
217 views

weak sign up page password placeholder text

According to this article the password 12345 was the third most popular password in use in the year of 2014. So why does SE use such a weak and commonly used password as a placeholder hint? ...
8
votes
1answer
125 views

Stack Exchange app submitting password in cleartext?

I have just noticed (by using the Charles web debugging proxy) that the Stack Exchange app is submitting username and password in cleartext at first startup. Isn't that something you shouldn't do, ...
8
votes
0answers
91 views

Time to upgrade SSL Cert(s) on *stackexchange.com

When browsing any StackExchange site, my Firefox console displays this warning: This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use ...
10
votes
1answer
123 views

What the @#$% is threadfrage.com?

While Googling for an earlier answer of mine on mathematica.stackexchange.com I got a hit pointing to http://mathematica.threadfrage.com/ which offers what looks like a complete mirror of the ...
5
votes
1answer
105 views

How many user accounts on SE sites get hacked per year?

I've run a few queries for users with spam penalties across SE sites (SEDE link) and it occurred to me that there may be some accounts that were hacked into and used for posting spam. While this is ...
13
votes
1answer
116 views

Chat adds arbitrary semicolon for no apparent reason [duplicate]

Go to chat Write "like http://xkcd.com" Wait a few moments for the submission to go through Resulting text is: I tried a few variations and, as long as the URL is within a quoted passage, and some ...
2
votes
1answer
73 views

Stackexchange used for phishing?

No so long ago I received a rather suspicious personal email related to a question I answered on SE.Economics. Hi Martin, I wanted some help with a question you answered on a blog about ...
5
votes
0answers
49 views

Opt-out of being logged-in without SSL

For me at least, partial SSL support with mixed content has been working for a long time. I'm aware that the SSL rollout is a slow process, but whenever I'm connected without an ‘s’ after the ‘http’, ...
4
votes
0answers
138 views

If anybody can upload image to Stack Exchange imgur accout, why do we send fkey?

I was developing userscript that uploads files to Stack Exchange Imgur app account. What I discovered during development can be seen here. The thing is that according to my test, any program can add ...
0
votes
0answers
525 views

Ask Ubuntu is giving the wrong certificate [duplicate]

When I go to www.askubuntu.com I get an error: When I click advanced it says: This server could not prove that it is www.askubuntu.com; its security certificate is from stackexchange.com. This may ...
0
votes
2answers
57 views

Sudden SSL error while connecting to Stack Exchange

I was surfing on Stack Exchange websites when I suddenly got the error message from Firefox about "Identity of this page could not verified" on all stackexchange sites. I had to confirm that I know ...
3
votes
0answers
219 views

logging in via Google not working under firefox - security error

I've tried to log in to this site via Google since I've been doing so for other StackExchange sites for a while now. However, it isn't working. When I click the "Log in using Google" link, it doesn't ...
7
votes
0answers
211 views

Login problem on: Firefox → math.stackexchange.com

I'm now using Firefox 31. I'm connected on many stackexchange web servers with the same login method. Unfortunately I can't connect within the exact same session, with the same browser, and with the ...
119
votes
1answer
1k views

Security hole: password change dialog doesn't ask for a user's current password

NB: Not asking for a current password allows an attacker who has somehow hijacked current session's cookies to hijack the account as well, in direct contravention of OWASP Guideline AT-011 What ...
0
votes
0answers
84 views

Universal sign-in and session

The user's session should be persistent between all sites. Signing in to meta.stackexchange.com, then navigating to wordpress.stackexchange.com should not ask the user for credentials a second time. ...
26
votes
1answer
820 views

Two factor authentication for Stack Exchange

Is there any possibility of setting up two factor authentication (2FA) for Stack Exchange OpenID authentication? I could just use my (already 2FA-enabled) Google account for Stack Exchange, but I ...
3
votes
0answers
173 views

Should Stack Exchange log out all users from the network and let them sign in again in the wake of the Heartbleed vulnerability?

I see that over the past few days the hype for "Heartbleed Security Vulnerability" has increased. Several sites administrators have take actions to prevent their servers from being compromised. ...
101
votes
2answers
3k views

Is Stack Exchange safe from Heartbleed?

Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed? Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
-3
votes
5answers
439 views

What's with the π (Pi) votes? [closed]

I know how to count and I know about integers. One of answers on my question has got π (Pi) votes. How is it possible? Has security of Stack Exchange been compromised?
14
votes
1answer
312 views

Why do I get a Japanese message when I update by swiping down?

I have a question. I use SE application on Android Nexus 5 4.4.2 and usually access SE site using it whether I can answer or not. At that time, I can see the refreshing message in Japanese once per 24 ...
1
vote
0answers
112 views

Generated code does not respect correct protocol (eg. HTTPS) [duplicate]

Browsing StackOverflow, I've found out, that not all resources are loaded over HTTPS (if using that protocol) Looking into code, I've found out, it's related to Imgur addresses: view-source:https:/...
2
votes
0answers
96 views

The new login process

I see the login page recently got an upgrade and the site started supporting https. First off: That's great! I've been waiting for this for years. Unfortunately it also came with some issues. Old ...
7
votes
1answer
80 views

How to report posts that seemingly try to hijack browsers?

Today, I stumbled over this question. It already had some downvotes, but to me it made (and still makes) the impression that the Javascript code's purpose was to hijack anyone who executes it. The ...
9
votes
1answer
284 views

Why am I being logged in as someone else?

I went to http://dev.stackexchange.com (I tried this out because I thought maybe there's a SE site for it, but it seems to redirect me to http://www.stackexchange.com) and logged in. I pressed the ...
-1
votes
1answer
242 views

Regards to DDoS attack [closed]

I am new to Stack Overflow (account created yesterday) and it's first time I have seen Stack Overflow suffer. More specifically, it's first time ever not being able to access Stack Overflow when I ...
1
vote
1answer
749 views

Account creation on Stack Overflow + Email verification

Infamous email verification process when creating an account. Very popular method. Utilized by every user, if not all who has an email account. A user enters an email address, clicks button, email ...
6
votes
1answer
132 views

Found a vulnerability, is there a bounty program?

I have found an exploit on all SE sites, that allows arbitrary code to be injected into the DOM. Where do I report this?
-9
votes
1answer
257 views

Please support HTTPS by default [duplicate]

Please redirect to an HTTPS connection by default on stackoverflow.com To illustrate the problem, please see the screenshot below where a man-in-the-middle attack is being used to forge responses ...
0
votes
1answer
66 views

Careers: add ability to hide some information on public profile

This week I was contacted directly by a recruiter who managed to figure out my e-mail from some combination of my StackOverflow careers page and my gravatar. For people with alumni email addresses, ...
3
votes
1answer
1k views

Google Shield on SO : Insecure Content

According to my other question, there appears to be a problem with Chrome and JavaScript. I'm seeing a little shield in the address-bar, meaning there's insecure content on SO. Is this a problem on ...
33
votes
2answers
468 views

Stack Exchange (main+chat) should block or render unprintable characters

Given that people share code on the main site and chat, it might be a good idea to either block or explicitly render control-characters and the like. For example, if you copy the following code block ...
4
votes
2answers
1k views

Please don't require USB storage permission for the Android app or justify why you need it [duplicate]

The Google Play webpage for the Stack Exchange Android app shows that it requires permission to modify or delete USB storage content. Translation: Modifying and deleting contents of USB storage ...
1
vote
1answer
81 views

Possible to steal an account using OpenID logins

It appears that it's possible for a malicious person to use the multiple OpenID logins feature to steal someone's account, if they have access to a logged-in session: Alice logs in to Stack Overflow ...
6
votes
1answer
73 views

Where should I ask a “question” about password security?

So, I got blasted for asking for help with a security question I had (got my rep cut in half!) and I'm wondering where I should ask it... (granted my rep was only 40...) Basically I know very little ...
7
votes
1answer
108 views

Flagged question as a security issue [duplicate]

On Stackoverflow, I have flagged a question for security purposes. The user has provided a link to the admin panel of their site along with a username and password. As these credentials are for a ...
0
votes
0answers
26 views

Connection downgraded to http after authenticating with SSL, auth broken with HTTP Everywhere [duplicate]

I opened https://meta.stackoverflow.com/, authenticated using Google OpenID, and was returned to https://meta.stackoverflow.com/ When using HTTPS Everywhere, authentication fails because of this: ...
61
votes
1answer
456 views

I can dispute flags without 10k rep, and so can you! [closed]

So I sent this bug report to SE by e-mail, but they told me to post it here... It seems that anyone can create dispute ("invalid flag") flags on any post, even if they don't have the 10k "moderator ...
2
votes
1answer
78 views

Non-https links to other StackExchange sites in User profile when using https

The links to other StackExchange sites in User profile -> Summary -> Accounts don't use https when the User profile was accessed using https.
8
votes
1answer
129 views

securing compromised account

I left my account logged in on a computer owned by someone else, they have decided to troll and so ive changed my password and cleared my session. I verified with SE openid that they did not log in ...
2
votes
1answer
135 views

Security feature? [duplicate]

I recently discovered that I don't need to enter my password to log into Serverfault after successfully logging out. I'm not sure this is as secure as intended. Steps to repeat (using Firefox 25.0.1)...
98
votes
6answers
3k views

Someone contacted me by email but my email is not public

Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked. The email suggested I'll star a bug \ feature ...
22
votes
0answers
310 views

When is the violation of OpenID 11.5.2 going to be fixed?

The Open ID spec requires that relying parties differentiate between HTTP and HTTPS URLs: 11.5.2. HTTP and HTTPS URL Identifiers Relying Parties MUST differentiate between URL Identifiers that ...