Questions tagged [security]

For posts about security issues centered around Stack Exchange. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
0
votes
1answer
135 views

How can masterbranch know what my stackoverflow e-mail is ? ( or is not )

I log into https://www.masterbranch.com and it has this option to link my stackoverflow user, but it ask me to type my email ( probably just to avoid me pointint to Jon's ) I type some random email ...
1
vote
2answers
373 views

What's this virus threat on Google Chrome when editing a Stack Overflow post?

When editing my previous post I got this: How does it come? It seems it only occurs on this particular post, Running Exe in Firefox why do I get an error, not on the one I am writing here for example....
7
votes
1answer
1k views

Should changing your password invalidate all existing logins?

Last night I changed the password for my Stack Exchange OpenID. As a security precaution, I would expect that all of my sessions be invalidated and to be asked to log in again on all sites where I use ...
9
votes
0answers
201 views

AVG 10 free detects “Input validation exploit” [duplicate]

Possible Duplicate: What's this virus threat on Google Chrome when editing a Stack Overflow post? I just got this while my computer was idling: Danger: Surf-Shield has detected active ...
16
votes
2answers
262 views

Is my Web Apps account under threat or am I being paranoid?

I've just checked my IP addresses on Web Apps (Link for Web Apps mods and developers): https://webapps.stackexchange.com/admin/show-user-ips/21 and a couple show up as being used once but the weird ...
4
votes
2answers
1k views

How can it be that people know my email adress?

Hi, I have a Stack Overflow account and I once asked a question about mounting sparse bundles. Now I just received an email from someone I don't know: Hi you, I just found your question about ...
4
votes
1answer
96 views

Should we contribute to questions related to software security?

Someone asked the question below on SO and it made one very energetic user (I rather not point fingers) lose his mind: https://stackoverflow.com/q/5759528/176769 The question has been edited, but the ...
12
votes
1answer
222 views

How does StackExchange DataExplorer prevent DOS attacks?

I have seen the page for composing Data Explorer queries. If I enter some stupid queries like: select * from Posts a, Posts b, Posts c ..... where 1=1 etc., how does StackExchange prevent it from ...
25
votes
1answer
554 views

Hijacked session: Signed in as someone else

I refreshed the SO home page and saw I was signed in as "Daniel Carvalho". I suspected an out-dated cache page, so I refreshed the page, but it persisted. I was able to view Daniel's user profile and ...
8
votes
1answer
127 views

Browsable folders on Stack Overflow Blog, may be not good for security?

http://blog.stackoverflow.com/wp-content/plugins/podpress/ http://blog.stackoverflow.com/wp-includes/ http://blog.stackoverflow.com/wp-admin/includes/ May be putting Options -Indexes in ....
3
votes
1answer
83 views

Who has privileges to see user's OpenId's?

Do any of the privileges/badges/mods on Stack Overflow enable people to see other users' open IDs? I created a unique email to access SO and it was recently attempted at being cracked, you know when ...
2
votes
2answers
73 views

No links at all in suspended accounts

There are some users which have an outstanding track-records: In the case of the picture above the user's account is actually suspended. The same way users over 2000 rep get the rel="nofollow" ...
15
votes
4answers
406 views

Vote to emergency suspend for three 5k+ or 10k+ users?

There was a case a few days back of a user going crazy and starting edit wars in all of his 42 questions, resulting in 50-100 new revisions per question. It being the weekend, it took 1-2 hours until ...
4
votes
3answers
727 views

The username “please delete me” to delete an account may have a (big) problem

You can see how to delete an account in Can I delete my account?. I don't particularly like the system but anyway, I think it has some kind of a flaw (or a "danger"). Since the username in Stack&...
7
votes
3answers
384 views

How is data.stackexchange.com not a massive vulnerability?

I'm not sure if you are aware of this, but Stack Exchange Data Explorer (SEDE) allows users to write their own SQL queries, and here is a list of popular queries. What steps were taken to make sure ...
31
votes
2answers
933 views

I'd like to see the last few IP addresses that my account was used from, please!

I think that as a matter of security (in the Firesheep age) I'd like to see the last IP address from which my account was accessed next to my name, somewhere in the top bar. I'd also ideally like a ...
4
votes
2answers
174 views

Photo.SE is trying to give me malware?

I'm just browsing SO questions and I see an ad for the Photo SE. This one in particular: I'm intrigued, so I click on it, and do you know what greets me? This: So I was just wondering why this was ...
2
votes
1answer
96 views

What information should I include / not include in my posts? [closed]

Is there any information other than a password that would be considered a security threat? I am primarily interested in knowing what could compromise the security of a server, rather than the ...
224
votes
10answers
9k views

Why doesn't the Stack Overflow team fix the Firesheep style cookie theft?

Firesheep sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this ...
11
votes
0answers
364 views

HTTP session hijacking vulnerability on Stack Overflow [duplicate]

Firesheep was released yesterday, a Firefox extension that makes it very easy to do HTTP session hijacking for users of insecure websites. It looks like Stack Overflow (and company) doesn't use SSL ...
28
votes
1answer
252 views

Questions can be made Community-Wiki by adding the right parameter when editing

See also https://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept. It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-...
10
votes
4answers
372 views

What is the difference between the Security proposals on Area51? Should they be merged?

There seems to be multiple proposals on Area51 about computer related security: Application Security Computer Security Network & Security Maybe they aren't exact duplicates, but for many ...
14
votes
4answers
942 views

Could Stack Overflow be damaged by “URL poisoning”?

This might not be a big problem, but say the following URL is a good Stack Overflow question: https://stackoverflow.com/questions/78756/what-do-you-use-to-keep-notes-as-a-developer Try this. Open a ...
12
votes
1answer
97 views

Security issues with tag wiki revision history

https://stackoverflow.com/posts/3607476/revisions (2k+ -- if security is working properly; I don't have a test account to check with) While I only have 68 upvotes in that tag (need 100 to edit), I ...
2
votes
2answers
440 views

Check links against the Web of Trust database

Background: In another of my questions, Ether brought up the idea to check links in an answer against the WOT database. Web of Trust is a community driven project, with the goal to make browsing safer ...
78
votes
7answers
2k views

Allowing images from external sources opens doors to serious security exploits

Note: Please see this answer for more info on how this poses a security risk. I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can ...
15
votes
3answers
506 views

Is SOFU prepared for a DDoS attack?

I can't recall any official statement on this topic, and I'm really afraid to lose this valuable resource. Is SO prepared to meet a DDoS attack? It's not like there is an actual occasion, but it would ...
19
votes
3answers
1k views

Fix the captcha to prevent bots from damaging content and annoying everyone

Don't get me wrong, my motives for this post are entirely altruistic. I enjoy StackOverflow and I want the system to be improved. I do not like your captcha. I like reCaptcha, but I also like ...
7
votes
5answers
995 views

What's your opinion about using minified urls? [duplicate]

Possible Duplicate: Can and should Stack Overflow automatically rewrite bit.ly links? I see minified urls used often, especially in comments. While they have obvious advantages, I don't like not ...
3
votes
11answers
262 views

What causes people to always hide data that helps in answering problems?

I've seen a long standing trend here, and I know some of the reasons why people do what they do. What they do is use 'thedomain.com' or 'example.com' when showing the actual domain at hand would make ...
33
votes
4answers
269 views

Allow https on careers

At the moment careers.stackoverflow.com redirects you if you try and access it using https. It would be nice if it allowed secure connections (personally I think it should be the default) given the ...
11
votes
1answer
2k views

How does Stack Overflow protect its sitemap?

The purpose of this question is not to find out how SO protects its sitemap in order to subvert it, so to that end, I don't expect an exact answer. However, questions around SO's sitemap have popped ...
7
votes
3answers
425 views

Is it a problem that 10% of SO emails tried were guessed by using the username and Gravatar account?

A recent Slashdot article speaks about how somebody was able to discover the email addresses of 10% of SO users through the username and Gravatar system. http://tech.slashdot.org/story/09/12/15/...
6
votes
3answers
508 views

How does Stack Overflow handle this case? [duplicate]

Possible Duplicate: What HTML tags are allowed on Stack Overflow, Server Fault, and Super User? I'm inserting the following script into my post, which is removed when shown. How did this happen? ...
6
votes
5answers
140 views

Questions about overriding security features on other user's computers

What's the best way to answer someone who asks a question that amounts to wanting to pwn their users' machines? All of the questions I've seen in this sphere seem more ignorant than malicious, but ...
0
votes
3answers
2k views

Invalid Security Certificate?

On careers.stackoverflow.com , I click on "file CV", and Firefox gives me this error: careers.stackoverflow.com uses an invalid security certificate. The certificate is not trusted because the ...
29
votes
3answers
653 views

Should I report a serious security issue on meta?

Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center. If I found a serious ...
97
votes
5answers
14k views

Is using Gravatar a security risk?

This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality. There are some facts: Gravatar's MD5 hash is an unsalted MD5 hash of an email address. A ...
6
votes
2answers
219 views

How to deal with questions/answers with a security vulnerability?

Sine a major goal of SO is to compile the best programming questions and answers on the internet, I'm wondering if there's more we can do to single out and/or correct cases where questions or answers ...
7
votes
2answers
267 views

force logout all locations

A nice feature would be to force logout from all other locations. I login on my work machine (I have shortcuts in my startup) and also on my home machine. If I were to leave that job unexpectedly I'...
12
votes
4answers
385 views

Security is Offensive?

I'm new to SO, so I'm trying to understand the rating system employed here as to what's offensive content. In particular, it seems that topics related to game enhancements made through reverse ...
2
votes
8answers
382 views

Does your profile contain your exact birthday? Is that safe?

Does your profile contain your real birthday, or is off by +/- n days (where n is small)? I know the birthday isn't explicitly available to users, but as suggested by this post, it would be easy to ...
3
votes
3answers
109 views

StackExchange - Permissions For Answering And Viewing Questions

I'm trying to evaluate the StackExchange platform for an Ask the Professional type of implementation and there are a couple of things that may or may not be deal breakers in the analysis and I'm ...
13
votes
7answers
690 views

Is it okay to discuss poor security practices?

I have experienced people actively hindering or flaming people who want to make public or discuss techniques that can break good security habits or schemes of languages, software or operating systems. ...