Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
2
votes
2answers
419 views

Is Stack Overflow's (SSL) log-in process optimal from a UX perspective? [duplicate]

Does Stack Overflow use SSL when transmitting passwords during the log-in process? This question comes up when you log-on, because there is no green lock in the browser when logging in. I do use the ...
14
votes
0answers
245 views

Firefox/Opera stops showing Gravatars linked over https [closed]

This is (e.g.) my profile in Opera 12.16: Other gravatars are also affected, but not in SE Chat. When I copy the image URL, I get https://www.gravatar.com/avatar/6d52c235ec6dd15f30bab444103e7af2?s=...
1
vote
0answers
106 views

I can log into Stack Exchange without my password [duplicate]

I found myself in the following situation. I forgot my password to my account. After resetting my key I logged into Stack Exchange. By mistake I forgot to save it in my password manager. Since I still ...
12
votes
1answer
584 views

Do Stack Exchange sites have any sort of security bug bounty program? [duplicate]

Not that I have been looking for security issues or anything. I am just curious if they have a policy regarding people searching for and reporting potential security issues?
4
votes
1answer
75 views

How should we handle questions with download links to code?

Regarding this question: https://stackoverflow.com/questions/18798125/java-eclipse-programming-need-support So yeah someone is learning Java and posted his code as a link. He also posted the code in ...
0
votes
1answer
228 views

Stackauth.com has certificate issued for *.stackexchange.com [duplicate]

The usual decision when the host name and the name in the certificate don't match is to reject the certificate. I see no reason to desensitize users to Man-in-the-Middle attacks by telling them: "it's ...
5
votes
1answer
81 views

AVG linkscanner alert when trying to review [closed]

I was trying to review posts on "reopen votes" when I got the following: Have you ever seen this before? How can I fix this? The site tells me there was an error trying to pull the next reopen vote. ...
10
votes
0answers
423 views

SSL certificate OCSP verification issue on cdn.sstatic.net, SO's JS/CSS not loading

Since the beginning of July I have intermittent trouble loading SO because I randomly can't verify the CDN's SSL certificate through OCSP. Network connectivity is otherwise good (traceroute & ping ...
3
votes
1answer
39 views

User flair image should be served over SSL as well

Unfortunately, the current flair image is only served over plain HTTP. Naturally, if you embed it directly on a page served over SSL, you will get mixed content warning from your browser. Please ...
5
votes
0answers
101 views

Help with dubious-looking password checking scripts? [duplicate]

A user has asked for assistance on a web-based multiple password-checking script for Tesco and Izotope websites. I can't think of any legitimate uses for this - even if the OP is intending to operate ...
6
votes
1answer
74 views

Logging in to Stack Overflow with private key

Most of the time you access Linux machines you'll use SSH with a private key. You add your public key to ~/.ssh/authorized_keys and done, you can login using your private key and passphrase. To serve ...
3
votes
0answers
46 views

Logged in VS Change password security issue [duplicate]

I'm using same the login to access Stack Overflow from 3 different computers. Once I forgot my password, and had to recover/change it. When I try to access the Stack Overflow page on some computer, ...
1
vote
0answers
94 views

Prevent users from creating multiple accounts [duplicate]

This question is just to prove how easy it is for the same person to create multiple accounts, since I have another primary account on Stack Overflow and Meta Stack Overflow. Refer to ...
12
votes
2answers
148 views

What information does Stack Overflow collect when signing in with OpenID?

What exact information does Stack Overflow collect when signing in with OpenID?
-2
votes
1answer
269 views

Able to view any deleted or private chat message, with 20 rep

Normally, if you try to view a deleted message or a message from a private room, you will not be able to view its content. Deleted messages show as "(deleted)" in the room itself, are absent from the ...
10
votes
0answers
247 views

Suddenly logged in as another user [duplicate]

Possible Duplicate: Hijacked session: Signed in as someone else Today I was in the same local network as two other stackoverflow users and we were all three logged into our accounts. User A was ...
8
votes
0answers
91 views

Stack Exchange doesn't log me out of the OpenID I signed in with [duplicate]

Possible Duplicate: Why am I stilled logged into Gmail *AND* StackOverflow after logging out of StackOverflow? Below is a scenario that can be seen like a small security issue: I open a new ...
1
vote
0answers
52 views

Validate when account email is changed

Please consider validating the email when it is change in the user account. Similar to the "Registration Account Email Validation". I believe that if someone hacks your account and try to change the ...
27
votes
4answers
846 views

How to deal with highly voted answers with security vulnerabilities?

There's already a question on how to deal with questions/answers with a security vulnerability. But that's not really what I'm asking. Here's the problem. There's a post in PHP that is highly upvoted ...
8
votes
1answer
2k views

I busted the Stack Overflow frame-buster-buster-buster [duplicate]

Possible Duplicate: Should Stack Exchange be using the X-FRAME-OPTIONS header? Yesterday I was hanging out in the PHP chatroom feeling a little bored, and then saw the leave button and remembered ...
1
vote
1answer
1k views

Why am I getting a security warning from Chrome browser when navigating to StackOverflow? [duplicate]

Possible Duplicate: Better HTTPS support for Stack Exchange sites Google Chrome warning of an SSL problem with Stack Overflow I tried to navigate to this Stack Overflow answer Hash algorithms - ...
20
votes
3answers
326 views

Don't give away incorrect password/username info

I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me ...
-1
votes
1answer
160 views

Is it possible to effectively control spamming or other undesirable behavior without relying on security through obscurity?

This is meant to replace a question I ended up deleting regarding the advantages of displaying a haiku rather than a clearer message on spam detection for unregistered users (link for 10k users). ...
4
votes
1answer
116 views

Is something wrong with the stack exchange root certificate? [duplicate]

Possible Duplicate: Better HTTPS support for Stack Exchange sites I usually visit Stackoverflow through https. Since a few days, Safari will warn me that it can't verify the identity of the ...
4
votes
1answer
329 views

How can we appropriately discourage the use of scanf(), gets() in the c tags [closed]

Almost all the code I see with c tags in questions uses gets() or scanf(). It's okay that new c coders get their input from stdin that way. But when someone fixes his code, in my opinion, he should ...
0
votes
1answer
131 views

Is it a phishing? [duplicate]

Possible Duplicate: Gender, Representativeness and Reputation in StackOverflow I've seen an advertisement in one of developer communities to help a certain research. When I went to a page, there'...
4
votes
0answers
55 views

Protect BlogOverflow logins with HTTPS [closed]

I've recently come to understand that StackExchange protects all main (and, by extension, meta and chat) site logins with HTTPS, even though the page itself is presented as HTTP. This supposedly ...
29
votes
1answer
891 views

Block SE sites from bugmenot.com

http://www.bugmenot.com/view/stackoverflow.com This is a troll heaven and there is no good reason for using a shared account from bugmenot on Stack Overflow or any other SE site. Blocking a site can ...
8
votes
2answers
192 views

How secure is using Google account authentication with Stack Overflow?

I would like to know how secure is it to use Google account authentication for logging in to Stack Overflow and other sister sites. Can one take any additional security measures?
41
votes
2answers
535 views

Is the Stack Overflow login secure against enumeration attacks?

I just noticed that when you go to https://stackoverflow.com/users/login#log-in pick "Stack Exchange" enter any email address submit the form without entering a password you will get a message like "...
9
votes
1answer
397 views

PHP version exposed on blogoverflow

The HTTP response header for Blog Overflow does not give a Server: string at all, assumably for (slight) security benefit. However, it does include an X-Powered-By: PHP/5.3.3 header, and also supports ...
36
votes
2answers
381 views

StackExchange OpenID provider should clearly use HTTPS

As discussed in this question on Meta.Security.SE, the SE OpenID provider seems to be using some sort of AJAX call to replace part of the page. The outer page uses plain HTTP, whereas the OpenID part (...
-2
votes
4answers
611 views

What are pros and cons of OpenID to programming savants?

tl;dr: Why was Open ID chosen as the preferred login provider on Stack Exchange; what are the privacy implications and risks, if any; and why should I care? I confess I'm a very green newbie. My own ...
13
votes
1answer
99 views

HTML not escaped in titles of questions for “deleted” events in profile “reputation” tab

This is working correctly in some instances, but not others <tr class="rep-breakdown-row"> <td class="rep-left"> <span class="rep-up">+1</span> ...
51
votes
3answers
2k views

Implement the Hacker Badge

When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge. from Stack Overflow Badge Feedback - Blog - Stack ...
11
votes
4answers
1k views

Is there a stack site for home automation / home security?

Perused the list, used search, and yet a home automation and/or home security site doesn’t seem to be available. Seems like something a bunch of techie types would want to share info about. Is it ...
22
votes
1answer
294 views

Improve SE OpenID logout security and user experience on shared or public machines

In May, Stack Exchange became an OpenID provider. It's now the first available choice when creating a new account on an SE site. When selecting it, you're offered a well-integrated login and ...
3
votes
0answers
151 views

Stack Overflow vulnerable to clickjacking [duplicate]

Possible Duplicate: Should StackOverflow be using the X-FRAME-OPTIONS header? Stack Overflow and all of the Stack Exchange sites are vulnerable to clickjacking. You need to set the x-frame-...
112
votes
4answers
3k views

Can Stack Overflow change the password criteria?

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria. With a 22 random lowercase characters (entropy 119 bits), the create ...
3
votes
1answer
99 views

Logging Out of Stack Overflow Does Not Log Me Out of Meta

I was wondering how come after logging out of Stack Overflow, I am still logged in on Meta. From Meta, I can still access Stack Overflow without ever having to log in again. Is there a security flaw ...
13
votes
1answer
472 views

Question on SE site being reported as a phishing site?

See this question on Meta Security SE: security se reported by chrome as a suspected phishing site They mention this question on Security SE: Is the Facebook login form using SSL without https in the ...
-1
votes
0answers
136 views

Accessing stackoverflow via HTTPS [duplicate]

Possible Duplicate: Why doesn't the Stack Overflow team fix the Firesheep style cookie theft? If I try to access stackoverflow.com via https I can see a log in pop up. Does that mean any sort ...
29
votes
1answer
294 views

How is the data explorer secured?

I understand that the SQL user probably doesn't have any sort of permission to modify the database, and that very heavy caching is probably used in addition to the fact that this is on a data dump ...
4
votes
2answers
253 views

SO password recovery, here's your password, just kidding

I tried SO password recovery, you enter your email and a captcha after you get an e-mail: here's your password : aaa3437 just kidding, go to this link .... is it considered a bad idea to ...
58
votes
1answer
1k views

Should Stack Exchange be using the X-FRAME-OPTIONS header?

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options I'll let the Mozilla docs do most of the talking, but ...
11
votes
1answer
202 views

Data is showing MvcMiniProfiler results. Is that expected?

Not sure if this is actually desired, but data is currently showing me (a SE non-dev) mvc-mini-profiler results, including all queries that are being run against the DB (not talking about data-...
5
votes
2answers
418 views

Removing someone's private information and edit history to protect them [duplicate]

Possible Duplicate: What should I do if a user posts sensitive information as part of a question or answer? I could not find a relevant Meta question for this issue. I've come across a couple of ...
2
votes
0answers
56 views

Privileges aren't enforced correctly when editing deleted posts [duplicate]

Possible Duplicates: Deleted posts can still be edited I'm able to edit my deleted question, but I cannot look at it. Permissions aren't enforced correctly in the post editor, allowing ...
8
votes
2answers
1k views

Why are Stack Exchange password requirements so strict? [duplicate]

I apologize for this off-topic post, but I hope it will be read by as many moderators as possible: I just wanted to register on Stack Overflow, to be able to leave ratings, etc. I didn't end up ...
5
votes
0answers
56 views

Points, tags and overlap

I noticed that there's a .net-4 tag with very little usage (2) and decided to suggest it should be rolled into the .net-4.0 tag. Needless to say I have no points in this tag. As the .net-4.0 is used ...