100

The Job Match Preferences page asks for minimum salary and telephone number, but this information appears to be transmitting back via unencrypted http session.

No, this is not a duplicate. We're talking about sensitive personal financial information on a single page, not general Q&A. This information should be encrypted. There's no excuse.

28
  • 59
    While I'm not sure there is a problem here and how big it is (plus I think I read the other day a quote from a team member that SSL for everything on Stack Overflow is not too far away any more), it's not right to close this as a duplicate of the generic "Y u no SSL???" question. As the OP says, the nature of some of the information transmitted through SO jobs is clearly much more sensitive than Q&A, and if SSL for everything isn't incoming, there is no reason not to suggest/consider switching Jobs to it ahead of time.
    – Pekka
    Feb 19, 2017 at 21:03
  • 7
    Wow. I'm glad I've never gotten to the interview stage with any company via SO Jobs. Now that I think about it, I wonder if I should just delete my Jobs profile altogether...
    – user554546
    Feb 20, 2017 at 0:50
  • 41
    @Jack because of a generally very important, but individually highly theoretical attack vector that would require access to your machine, your router, the nameservers you use, or Stack Overflow's own server infrastructure? To... find out your telephone number and salary range? Really? Maybe this needs to be fixed, but the idea that you specifically were/are at high risk and thus need to shut down your account seems rather silly.
    – Pekka
    Feb 20, 2017 at 1:18
  • 26
    Desired pay is not really "sensitive personal financial information".
    – nobody
    Feb 20, 2017 at 1:20
  • 22
    It's worth noting that SO will be HTTPS everywhere very soon, but I'll give a heads up to the profiles team about this anyway
    – Dean Ward
    Feb 20, 2017 at 9:50
  • 16
    @Pekka, any router on the Internet can sniff unencrypted http POST data. Feb 20, 2017 at 14:53
  • 7
    @AndrewMedico I would be very uncomfortable with people knowing my desired salary and phone number. I'm not sure how you can say it's not sensitive personal info.
    – DavidG
    Feb 20, 2017 at 16:03
  • 2
    @AndrewMedico I have to agree with DavidG. No, it is not "what is your current salary?" but most people are sensible when looking for a new position and either really want to get away from a bad employer and thus willing to make a lateral move with regard to pay, or would be looking for a reasonable bump in salary so their current salary could be guesstimated fairly closely. Feb 20, 2017 at 16:11
  • 3
    @TylerH I think perhaps we are getting tied up in legal definitions rather than the more emotive side here. I consider my desired salary to be very personal, though it may not be a good measure to identify me in a data set. I would be very annoyed if that information was given out to anyone without my express permission.
    – DavidG
    Feb 20, 2017 at 16:27
  • 5
    @TylerH No, I'm not suggesting it's personally identifiable, I'm just saying it's personal. That's a very different definition. The point is that a "hacker" in this scenario probably already knows who I am so I'm already identified.
    – DavidG
    Feb 20, 2017 at 16:38
  • 4
    We are talking about the Internet and who knows what legal/illegal data aggressors. If you don't think that thousands of phone numbers with matching desired salary numbers is valuable information, you're not paying attention. Feb 20, 2017 at 16:40
  • 2
    @TylerH Your password also cannot be used to identify you, would you like to share it here perhaps? :)
    – DavidG
    Feb 20, 2017 at 16:40
  • 5
    @TylerH, this is definitely not a duplicate of that question. This question is not about general site encryption. Are you saying that if SO was charging credit cards for some service that the CC entry page should not be encrypted because the whole site is in the process of being encrypted? Of course not. This page is a security problem. It needs to be encrypted immediately, or those questions need to be removed immediately. Feb 20, 2017 at 16:55
  • 2
    @ThomasMcLeod No, did you read my previous comment?
    – TylerH
    Feb 20, 2017 at 17:18
  • 4
    @TylerH, yes I read it. Maybe you do not understand how data aggregation works. Small pieces of data are gathered from multiple sources, sometimes hundreds, of sources. The data is matched using different techniques, some more reliable than others. In this case, there is a non-temporal key match to the phone number. Spammers and legitimate advertisers love this information and certainly pay for it. So do identity thieves. Feb 20, 2017 at 17:26

1 Answer 1

2

Since we moved the entire network to HTTPS, I'm marking this as :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .