Questions tagged [security]
For posts about security issues centered around Stack Overflow. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!
81
questions
7
votes
1
answer
139
views
How to turn on two-step verification on Stack Overflow [duplicate]
I just joined Stack Overflow and I want to enable two-factor authentication, but I couldn't find it. Can you please tell me how to enable it?
I couldn't find the security tab in the settings; I looked ...
6
votes
1
answer
172
views
Is it possible to associate my Stack Overflow account with more than one Google Login?
The company where I work does monitor everything we do by intercepting all HTTPS using proxy.
I do not trust them and moreover I suspect them to monitor all of our activities.
So I prefer to not use ...
22
votes
0
answers
272
views
Adding Security log option for seeing login activites
Recently I was logged out of my SO account automatically. This happened 2 times in 2 days (like 1 today and 1 yesterday). Note also that this has happened in the past as well. Upon seeing this, I am ...
-24
votes
1
answer
271
views
User (well, answerer) security on Stack Overflow [duplicate]
Earlier on I was perusing python questions, when I stumbled over a question - now deleted, asking something along the lines:
How can I access this website with Selenium? Why is the page blank when I ...
20
votes
1
answer
2k
views
Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?
Just wondering if there's a risk to a user's machine by clicking "Run Snippet" in questions like this one
I'm suspicious because on the face of it the question doesn't look like it needs to ...
2
votes
0
answers
72
views
Add an option in Settings to log out of a device that is logged in to your account
If someone is hacked/has a hacker running about in their account or just in general want to sign out on specific devices, having a list of devices currently logged in on the account under My Logins or ...
58
votes
2
answers
18k
views
Adding HTML tags or HTML-tag-like to a title, breaks rendering
This question cannot be rendered.
Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea> or some other tag to the title, as ...
238
votes
4
answers
4k
views
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
A friendly reminder to all those who need it:
Executing code you found online is BAD!!*
Once more for the people in the back:
Executing code you found online is BAD!!!!!*
There's a great post on the ...
5
votes
1
answer
269
views
Imgur secure connection failing
I was reviewing this question on Stack Overflow, it has two links to https://i.stack.imgur.com. I'm pretty sure these are images added to the question with the image tool (powered by Imgur) so I ...
67
votes
1
answer
1k
views
Using a personal Stack Overflow account for a Team potentially allows your employer to take it over [closed]
This is based on this support request from fazy about several potential issues due to the fact that SO and Teams account are not separate entities. As this received no response, I tried one of the ...
20
votes
1
answer
1k
views
What kind of Access Control is used on Stack Overflow?
Recently I have done some research about different Access Control models and policies. My accent was on Role-Based Access Control, and one of the main disadvantages of it is that it is not dynamic (...
13
votes
0
answers
304
views
Breach or very strange coincidence?
It has been too long since I've updated my password on Stack Overflow, so I decided to do so a couple of days ago. I accidentally set it as the same password that I used on an old (forgotten, unused ...
-10
votes
1
answer
149
views
Can I post executable binaries to into Stack Overflow?
I have updated the compiler, and I am struggling to get the binaries generated by the new compiler to work. I figure that besides describing the problem and the command lines involved, it will ...
9
votes
0
answers
105
views
Why does Stack Overflow not use Content-Security-Policy HTTP header to prevent XSS attacks?
OWASP recommends using Content-Security-Policy HTTP header to prevent XSS attacks.
I inspected Stack Overflow HTTP requests in the browser and didn't find any Content-Security-Policy HTTP header.
Why ...
49
votes
1
answer
694
views
Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?
My friend and I were writing a question title on this site, We wanted to use an HTML tag, but we saw to our surprise that the title of the question had interpreted our HTML Tag. I was wondering if ...
12
votes
1
answer
456
views
Does Stack Overflow prevent cartels? [duplicate]
Let's say I organize a group of users (or fake users/bots) with malicious intent to inflate reputation. They will ask questions and upvote each others' answers. To keep things safe, questions will ...
85
votes
1
answer
1k
views
Will there be any further updates on the security incident of May 5, 2019?
Stack Overflow had a security incident back in May, in which a small amount of user data was compromised. This received a lot of attention, and the company did a great job communicating their initial ...
2
votes
0
answers
109
views
What is happening with this page? [duplicate]
I don't quite know where to begin with, how to pose this question or even if this is the correct site ...
Spoiler: Beware of the pop-up when clicking the link below.
I found by link on Google Search,...
55
votes
2
answers
999
views
Reassigning window.name inside a Stack Snippet results in unexpected popup
Run the following snippet twice (either in the post proper, or in the snippet editor). On subsequent runs, rather than the form posting to the embedded result iframe, a new window is opened:
...
157
votes
2
answers
1k
views
With Regards to the Security Update
I'm not really sure what's the right avenue to do this so I'll try meta. I promise to take it well if this gets closed or downvoted :]
I just wanted to say thank you for the way you're handling the ...
1042
votes
5
answers
33k
views
Embedding Facebook avatars enables tracking of Stack Overflow users
By now, everyone who follows technology should be aware of the scandals around Facebook's ethics and data privacy. Many users distrust them and are uncomfortable with their data collection practices.
...
106
votes
2
answers
4k
views
What actions have been taken after the data leak reported on Feb 5 2019? [duplicate]
On Feb 5, 2019, a data leak was reported and a Stack Overflow Product Manager admitted to causing it.
We got an "oops, sorry, won't happen again". For some, this is not enough, considering it's not ...
35
votes
1
answer
812
views
Generated <script> contents considered harmful</script> [closed]
An XSS vulnerability and a data validation bug exist in Stack Overflow Teams that can be used together to trigger a XSS against teammates. This isn't very exploitable in practice.
When you are ...
9
votes
0
answers
152
views
Is my "Comment Evaluator 5000™" campaign email legit? [duplicate]
How do I know a "Comment Evaluator 5000™" email I received is legit?
I mean, I got an email from some weird address (comment-classification@stackoverflow.email), note "stackoverflow.email", not "...
0
votes
1
answer
256
views
How to reduce answers with security issues?
I think security is a big issue on Stack Overflow. There are tons of old answers with bad advice and some with a high amount of upvotes. We already have everything we need to handle bad answers by ...
14
votes
2
answers
703
views
Suspicious email about the end of OpenID support
I've just received a email from SO titled "ACTION NEEDED: We are deprecating OpenID suppoort".
I haven't used OpenID as the login method for my account if memory serves me right. Besides, the ...
126
votes
1
answer
2k
views
Your team memberships are leaked to other websites [closed]
Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css.
theme.css ...
7
votes
2
answers
285
views
Suspicious Firefox Add-in for Stack Exchange
I saw a recently added Firefox add-in specifically for Stack Overflow, to remove the side-bar links, but it seems suspicious to me.
Maybe I'm being over-paranoid but:
1. Excessive Permissions?
...
10
votes
1
answer
633
views
What email or MD5 is used for the Gravatar URI?
The URI generated for my Gravatar link contains an unique identifier.
As this is not the MD5 of my email, what is it?
If the MD5 uses somebody else's email, how can I retrieve that?
If something ...
11
votes
0
answers
110
views
Unable to Revoke Applications From Profile
I have been attempting for the last week to temporarily remove some apps that I have provided read/write access to act on behalf of myself, but I am not having any success.
As you can see in the ...
4
votes
0
answers
57
views
Ask before merging data from different credentials [duplicate]
I log to my account with Gmail, and I use my account as anonymous. Once I accidentally logged in with Facebook, and StackOverflow automatically imported my picture and real name.
It didn't ask can it ...
1
vote
0
answers
160
views
stackoverflowr.com proxying stackoverflow.com for phishing? [duplicate]
I came across a clone of stackoverflow.com today coming through Bing searches. Not just content scraping, but a full-on proxy server clone. All the latest content appears on this duplicate site ...
-15
votes
2
answers
242
views
Has SO considered adding facilities for removing or obfuscating sensitive data contained in posts? [duplicate]
Many OPs cut and paste raw text such as code, config files and error messages into their posts. Many overlook passwords, directories, binary meta data and other sensitive information which can ...
6
votes
2
answers
361
views
The Impact of Information Sources on Code Security
According to the highly decorated paper The Impact of Information Sources on Code Security
Internet resources such as Stack Overflow are blamed for promoting insecure solutions that are naively ...
95
votes
6
answers
3k
views
Poorly worded 8-year old question with hundreds of votes and security implications
TL;DR. A question with a title that asks specifically for crypto code, all answerers think it's reasonable to ignore security feedback, specifically because the question is poorly worded. Years in the ...
6
votes
0
answers
214
views
Should questions that contain insecure code be answered?
I frequent the encryption tag on Stack Overflow and, as an individual, am very passionate about security best practices. I often stumble upon questions that implement incredibly insecure code, for ...
49
votes
3
answers
2k
views
Is Stack Overflow secure even when not using HTTPS?
I noticed stackoverflow.com doesn't force the use of an HTTPS connection even when the user is logged in.
I've found this question on security.stackexchange.com on "Why is Stack Overflow not using ...
1
vote
0
answers
121
views
Enforce HTTPS at least for certain areas, don’t transmit authentication cookies via HTTP
Come on guys – it’s almost 2017, and Stack Overflow still runs in plain HTTP mode by default (like all of the Stack Exchange sites, BTW). By doing so, Stack Overflow exposes a set of ...
4
votes
1
answer
287
views
Editing of Insecure Code Examples
I had a discussion with some security experts a few days ago and they said that some content on Stack Overflow is dangerous, because some provided code snippets by other developers will help to evade ...
-27
votes
1
answer
327
views
Stack Overflow account security is vulnerable
As Stack Overflow is a worldwide recognized community. I think the account safety of the users should not be compromised.
It looks like our Stack Overflow accounts are vulnerable to password hack ...
184
votes
1
answer
5k
views
Is email from do-not-reply@stackoverflow.email legit?
I've just received an email from do-not-reply@stackoverflow.email titled Announcing the Stack Overflow Developer Story.
Is this a legit email? If so, how come you use this domain while other emails (...
5
votes
2
answers
2k
views
Why is window.open() blocked?
When I run this code from a server, it works just fine, but it doesn't work in a Stack Snippet:
var wind;
function openWindow() {
wind = window.open("https://www.google.com/", "wind", "...
64
votes
1
answer
3k
views
adzerk serving ads from adsafeprotected
I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as ...
-3
votes
1
answer
333
views
Is Stack Overflow a secure site? Why is Google Chrome showing a virus icon? [duplicate]
Is it only with me or also with others?
When I visit https://stackoverflow.com/questions/ask:
I see Google Chrome is showing a virus icon and I was scared. Am I getting any exploits when that icon ...
-14
votes
1
answer
330
views
Stack Overflow should check what URL the “ask a question” form is sent from
I discovered a security vulnerability on Stack Overflow. Currently, the server doesn’t check what URL the “ask a question” form is sent from. That means third-party websites are able to “secretly”...
-18
votes
1
answer
102
views
Allow up/downvotes on close/open proposals
It seems as if any five people can go around and start mass-closing questions with enough reputation.
What security do we have against this?
52
votes
1
answer
2k
views
Changing Stack Overflow password does not require the old password
When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old ...
0
votes
1
answer
192
views
Very slight possibility of malware or something? [duplicate]
Just FWIW, I clicked on a totally ordinary "add comment" link and this appeared,
Just possibly, could it be due to some ad content or other on the page?
At the time I had just opened the browser ...
-1
votes
1
answer
131
views
Can I be doxxed on Stack Exchange?
Doxing is "the Internet-based practice of researching and broadcasting personally identifiable information about an individual."
Assuming I haven't posted anything about my identity, can I be doxxed ...
3
votes
0
answers
60
views
Should we do something about the answers to "Remove Server Response Header IIS7"?
Remove Server Response Header IIS7 is a popular question that deals with a security topic. It has a number of answers with a different approach, but according to the comments, some of these answers ...