104

We will be upgrading our OpenSSL usage this morning to remove the Heartbleed vulnerability. I'll update this post when the live load balancers have been compiled and deployed against 1.0.1g. We have to test just a bit and I'm just returning from a trip, so it'll be a few hours before this gets rolled out. Update: We have rolled out a fix for the active ...


91

Here's one way they could have done it. I was able to link you to a GitHub account based on a Dropbox link you posted (with a quick Google to make the connection). From there, I cloned your repository and your email address was visible in the raw Git commit data. I also found a MozillaZine account, but I couldn't find any Chromium bug tracker connections....


80

For context: I'm someone who (A) enjoys the heck out of the Stack Exchange network, (B) very much appreciates when others take (my) data security seriously, and (C) can program sorta well but nowhere near on the level needed to evaluate security vulnerabilities (viz., I will never earn one of these rewards myself). I think this is a fantastic idea. Site ...


62

We will be purchasing certificates for the network this week (dev is already in place), but there's still a lot left to do on the move to SSL. If you're curious about the details, you can read a recent blog post I wrote about it here. It's far from a trivial task, but we're moving towards making SSL available and then the default. I'll continue to blog ...


35

Our apologies, not super clear on what happened here honestly. When we saw this post a team member went looking for your ticket, found it (reply should be forthcoming, I don't have access to that system personally) and sent the details my way. A fix has been deployed. We're going through our old tickets to see if anything else fell through the cracks, and ...


34

Kevin Montrose's concern is that ordinary users will be confused by an entropy meter. That does not justify blocking good passwords, which is what the current system does. A simple way to satisfy both criteria: Calculate entropy in the background. Any password with entropy over some threshold will get accepted. Passwords with less entropy than that fall ...


34

This is a fantastic idea. As I mentioned in a comment above, it has been requested by the security community for a long time, and will undoubtedly contribute greatly to the overall security of the platform (and possibly the security research community at large, if any findings are written up and published). I am sure you've received this advice already, ...


33

According to this check, it is vulnerable: http://filippo.io/Heartbleed/#stackoverflow.com Edit: Fixed now. It can still be seen in this list of top 10000 sites that, like many others, it was vulnerable.


33

We don't give clients keys to just upload whatever they want for two reasons, and this is one of them. The other reason is that we need to check every creative for not just security, but also relevancy. So if something gets on to our CDN for Adzerk to put into rotation, it's because an employee put it there. We have a small handful of trusted partners (...


32

The user that contacted you performed a search, found your question, then visited your user page. He had no other contact with any of your other content. That's all the information our logs show. As others have said, it's possible the user has access to an MD5-to-email lookup. To mitigate the ease of obtaining gravatar hashes, we've already removed ...


28

The situation mentioned by @D.W. is very true. A simple calculation below suggests that all emails with less than 11 characters must be cracked, and I will give a motivation to do so. The data dump here already contains all the MD5 hashed emails and the corresponding userid. Hence, it would be possible to do a brute force matching and there are someone do ...


26

Fixed in build rev 2014.1.7.1823 on meta and 2014.1.7.1277 on sites. The POSTed data now gets validated against the list of flag types available to you. Additionally, it's now impossible to GET the popup GUI with the additional options (by using show-invalid=true) if you're not a 10k user.


24

The mail address in your profile is private, only mods and SE employees can see it and they are not allowed to share it with third parties. Sharing PII like mail addresses is covered by the moderator agreement, and each access to that information is logged as well. SE doesn't sell mail addresses or something like that as far as I know. The usual way someone ...


23

I'd agree that from a privacy standpoint, banning users hosting images on servers they control would be beneficial. In the DMZ it's been a long standing acknowledgement that people's locations can be uncovered in this way (well apart obviously from users using things like Tor) unless the user default blocks image loads. So restricting image links (or ...


22

There are some technical aspects of the Stack Exchange platform that could, at least in principle, allow someone to deduce your email address. I somehow doubt that it's what happened to you, but I'll document it here for posterity, since I haven't seen it written down anywhere else. In particular, the MD5 hash of your email address is made publicly visible ...


22

Whilst I can't fault the idea of Bug Bounties, there is some evidence coming through that they many sites on such programmes retain significant bugs even after a substantive period. So I would say get an application security testing company to make recommendations first and implement them (Declaration I don't work for one, although I do security test web ...


22

SE did make a statement on what kind of data was affected by the security breach, and notified the affected users. That is the reasonable minimum I'd expect from any company. Anything more could be dismissed as idle curiosity by the SE community, but I don't think that is the only reason we have to ask for more details on this. I mean, it's still a good ...


21

That's not pi, that's a table. This should indicate a good answer, as the table is still on its feet. If it was bad, this would happen:


21

Can a hacker who hacked Facebook log into a linked Security.StackExchange account and suspend other accounts, edit the questions to point to malicious URLs, or delete content? That's kind of the point of going in and changing your password and re-securing your Facebook account if your login information was compromised - so that people can't login to your ...


20

That's not PI, it's two T's. The vote count is base64 encoded (presumably someone forgot to decode it somewhere, or encoded it twice by accicent). Decoding it tells us that the real vote count is 211.


20

Thanks for reporting! This has been fixed in rev 2020.11.4.37941.


19

Update: Thanks for the help, Gilles, Manishearth, and snailplane. Gilles' version ([\x00-\x08\x11\x12\x14-\x1f\x7f-\x9f]) will be going into production later today. Could something be done about this? Sure could! I'm looking at putting this regex into production: [\x00-\x08\x11\x12\x14-\x19\x1A-\x1F\x7F] to strip out every control character that's not ...


19

A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am informed that noreferrer by itself would work)


18

There is now the Stack Exchange site: Internet of Things. Its help center defines as on topic, questions about: controlling, automating and sensing the environment using electronics ('smart devices'), consumer technology used for home automation, industrial applications of the Internet of Things, or the security, privacy, reliability and safety ...


18

We were not directly affected. The parser bug was introduced: The earliest date memory could have leaked is 2016-09-22 Stack Exchange went off CloudFlare around June 2016. The caveat is that it is entirely possible that some services we use were compromised - after all, a large amount of the Internet goes through CloudFlare.


17

Any way to get people to spend more time looking for security vulnerabilities and disclosure them responsibly is an obvious win. Not just for the Stack Exchange network admins, but for everyone using the site.


17

Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this. Many image hosting services delete their images after a certain period of time. After this has happened, it can be IMPOSSIBLE to get a replacement. There is only ...


16

So that request form has been broken for a long time, but they (recently?) rolled out a new one: http://bugmenot.com/removal.php Since that doesn't require any fancy footwork server-side, I went ahead and submitted SO, SU, SF and SE along with explanations for why the corresponding BMN pages are currently filled with unusable accounts... These have now all ...


16

Thanks for bringing this up. You're absolutely right that this is a security issue, but it's been this way forever without a lot of reported problems (that's not a rationalization, I just mean to show that it isn't super pressing). The problem is only truly exploitable if we open up an XSS vulnerability on our site, or you leave yourself logged in on a ...


Only top voted, non community-wiki answers of a minimum length are eligible