Questions tagged [security]

For posts about security issues centered around Stack Overflow. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
6 votes
1 answer
155 views

Is it possible to associate my Stack Overflow account with more than one Google Login?

The company where I work does monitor everything we do by intercepting all HTTPS using proxy. I do not trust them and moreover I suspect them to monitor all of our activities. So I prefer to not use ...
21 votes
0 answers
240 views

Adding Security log option for seeing login activites

Recently I was logged out of my SO account automatically. This happened 2 times in 2 days (like 1 today and 1 yesterday). Note also that this has happened in the past as well. Upon seeing this, I am ...
-24 votes
1 answer
267 views

User (well, answerer) security on Stack Overflow [duplicate]

Earlier on I was perusing python questions, when I stumbled over a question - now deleted, asking something along the lines: How can I access this website with Selenium? Why is the page blank when I ...
20 votes
1 answer
2k views

Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?

Just wondering if there's a risk to a user's machine by clicking "Run Snippet" in questions like this one I'm suspicious because on the face of it the question doesn't look like it needs to ...
3 votes
0 answers
72 views

Add an option in Settings to log out of a device that is logged in to your account

If someone is hacked/has a hacker running about in their account or just in general want to sign out on specific devices, having a list of devices currently logged in on the account under My Logins or ...
58 votes
2 answers
18k views

Adding HTML tags or HTML-tag-like to a title, breaks rendering

This question cannot be rendered. Simple multi-colored textarea based editor neither on question view, or list view. The bug is triggered by adding <textarea> or some other tag to the title, as ...
237 votes
4 answers
4k views

Blindly Copy-Pasting Code is BAD: A Gentle Reminder!

A friendly reminder to all those who need it: Executing code you found online is BAD!!* Once more for the people in the back: Executing code you found online is BAD!!!!!* There's a great post on the ...
67 votes
1 answer
1k views

Using a personal Stack Overflow account for a Team potentially allows your employer to take it over [closed]

This is based on this support request from fazy about several potential issues due to the fact that SO and Teams account are not separate entities. As this received no response, I tried one of the ...
5 votes
1 answer
225 views

Imgur secure connection failing

I was reviewing this question on Stack Overflow, it has two links to https://i.stack.imgur.com. I'm pretty sure these are images added to the question with the image tool (powered by Imgur) so I ...
20 votes
1 answer
1k views

What kind of Access Control is used on Stack Overflow?

Recently I have done some research about different Access Control models and policies. My accent was on Role-Based Access Control, and one of the main disadvantages of it is that it is not dynamic (...
13 votes
0 answers
303 views

Breach or very strange coincidence?

It has been too long since I've updated my password on Stack Overflow, so I decided to do so a couple of days ago. I accidentally set it as the same password that I used on an old (forgotten, unused ...
-10 votes
1 answer
146 views

Can I post executable binaries to into Stack Overflow?

I have updated the compiler, and I am struggling to get the binaries generated by the new compiler to work. I figure that besides describing the problem and the command lines involved, it will ...
9 votes
0 answers
103 views

Why does Stack Overflow not use Content-Security-Policy HTTP header to prevent XSS attacks?

OWASP recommends using Content-Security-Policy HTTP header to prevent XSS attacks. I inspected Stack Overflow HTTP requests in the browser and didn't find any Content-Security-Policy HTTP header. Why ...
49 votes
1 answer
688 views

Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?

My friend and I were writing a question title on this site, We wanted to use an HTML tag, but we saw to our surprise that the title of the question had interpreted our HTML Tag. I was wondering if ...
12 votes
1 answer
454 views

Does Stack Overflow prevent cartels? [duplicate]

Let's say I organize a group of users (or fake users/bots) with malicious intent to inflate reputation. They will ask questions and upvote each others' answers. To keep things safe, questions will ...
1041 votes
5 answers
33k views

Embedding Facebook avatars enables tracking of Stack Overflow users

By now, everyone who follows technology should be aware of the scandals around Facebook's ethics and data privacy. Many users distrust them and are uncomfortable with their data collection practices. ...
7 votes
2 answers
276 views

Suspicious Firefox Add-in for Stack Exchange

I saw a recently added Firefox add-in specifically for Stack Overflow, to remove the side-bar links, but it seems suspicious to me. Maybe I'm being over-paranoid but: 1. Excessive Permissions? ...
85 votes
1 answer
1k views

Will there be any further updates on the security incident of May 5, 2019?

Stack Overflow had a security incident back in May, in which a small amount of user data was compromised. This received a lot of attention, and the company did a great job communicating their initial ...
2 votes
0 answers
109 views

What is happening with this page? [duplicate]

I don't quite know where to begin with, how to pose this question or even if this is the correct site ... Spoiler: Beware of the pop-up when clicking the link below. I found by link on Google Search,...
55 votes
2 answers
976 views

Reassigning window.name inside a Stack Snippet results in unexpected popup

Run the following snippet twice (either in the post proper, or in the snippet editor). On subsequent runs, rather than the form posting to the embedded result iframe, a new window is opened: ...
157 votes
2 answers
1k views

With Regards to the Security Update

I'm not really sure what's the right avenue to do this so I'll try meta. I promise to take it well if this gets closed or downvoted :] I just wanted to say thank you for the way you're handling the ...
6 votes
0 answers
212 views

Should questions that contain insecure code be answered?

I frequent the encryption tag on Stack Overflow and, as an individual, am very passionate about security best practices. I often stumble upon questions that implement incredibly insecure code, for ...
106 votes
2 answers
4k views

What actions have been taken after the data leak reported on Feb 5 2019? [duplicate]

On Feb 5, 2019, a data leak was reported and a Stack Overflow Product Manager admitted to causing it. We got an "oops, sorry, won't happen again". For some, this is not enough, considering it's not ...
3 votes
0 answers
89 views

Why does Stack Overflow not redirect to HTTPS if I am logged in? [duplicate]

I often open Stack Overflow from result of search engine. Unfortunately the search engine, let name it G**g**, set the link to http instead of https. I expect Stack Overflow to redirect to HTTPS ...
35 votes
1 answer
806 views

Generated <script> contents considered harmful</script> [closed]

An XSS vulnerability and a data validation bug exist in Stack Overflow Teams that can be used together to trigger a XSS against teammates. This isn't very exploitable in practice. When you are ...
126 votes
1 answer
2k views

Your team memberships are leaked to other websites [closed]

Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css. theme.css ...
8 votes
0 answers
151 views

Is my "Comment Evaluator 5000™" campaign email legit? [duplicate]

How do I know a "Comment Evaluator 5000™" email I received is legit? I mean, I got an email from some weird address (comment-classification@stackoverflow.email), note "stackoverflow.email", not "...
0 votes
1 answer
252 views

How to reduce answers with security issues?

I think security is a big issue on Stack Overflow. There are tons of old answers with bad advice and some with a high amount of upvotes. We already have everything we need to handle bad answers by ...
3 votes
0 answers
68 views

Is http://stackflow.info/ anyhow related to Stack Overflow? [duplicate]

I've found this site in Google Search results: http://stackflow.info/ It is related anyhow with Stack Overflow official site? If not, how can I report it to Stack Overflow administrators?
14 votes
2 answers
702 views

Suspicious email about the end of OpenID support

I've just received a email from SO titled "ACTION NEEDED: We are deprecating OpenID suppoort". I haven't used OpenID as the login method for my account if memory serves me right. Besides, the ...
10 votes
1 answer
620 views

What email or MD5 is used for the Gravatar URI?

The URI generated for my Gravatar link contains an unique identifier. As this is not the MD5 of my email, what is it? If the MD5 uses somebody else's email, how can I retrieve that? If something ...
11 votes
0 answers
110 views

Unable to Revoke Applications From Profile

I have been attempting for the last week to temporarily remove some apps that I have provided read/write access to act on behalf of myself, but I am not having any success. As you can see in the ...
4 votes
0 answers
57 views

Ask before merging data from different credentials [duplicate]

I log to my account with Gmail, and I use my account as anonymous. Once I accidentally logged in with Facebook, and StackOverflow automatically imported my picture and real name. It didn't ask can it ...
126 votes
8 answers
4k views

What would happen if I posted thoughts on how to write a Stack Overflow robot?

I've been mulling recently over how one might go about designing a Stack Overflow robot, to gain as much rep as possible without being detected as a bot. Let me make it very clear that I have no ...
1 vote
0 answers
160 views

stackoverflowr.com proxying stackoverflow.com for phishing? [duplicate]

I came across a clone of stackoverflow.com today coming through Bing searches. Not just content scraping, but a full-on proxy server clone. All the latest content appears on this duplicate site ...
-15 votes
2 answers
236 views

Has SO considered adding facilities for removing or obfuscating sensitive data contained in posts? [duplicate]

Many OPs cut and paste raw text such as code, config files and error messages into their posts. Many overlook passwords, directories, binary meta data and other sensitive information which can ...
6 votes
2 answers
353 views

The Impact of Information Sources on Code Security

According to the highly decorated paper The Impact of Information Sources on Code Security Internet resources such as Stack Overflow are blamed for promoting insecure solutions that are naively ...
95 votes
6 answers
3k views

Poorly worded 8-year old question with hundreds of votes and security implications

TL;DR. A question with a title that asks specifically for crypto code, all answerers think it's reasonable to ignore security feedback, specifically because the question is poorly worded. Years in the ...
5 votes
2 answers
2k views

Why is window.open() blocked?

When I run this code from a server, it works just fine, but it doesn't work in a Stack Snippet: var wind; function openWindow() { wind = window.open("https://www.google.com/", "wind", "...
49 votes
3 answers
2k views

Is Stack Overflow secure even when not using HTTPS?

I noticed stackoverflow.com doesn't force the use of an HTTPS connection even when the user is logged in. I've found this question on security.stackexchange.com on "Why is Stack Overflow not using ...
1 vote
0 answers
120 views

Enforce HTTPS at least for certain areas, don’t transmit authentication cookies via HTTP

Come on guys – it’s almost 2017, and Stack Overflow still runs in plain HTTP mode by default (like all of the Stack Exchange sites, BTW). By doing so, Stack Overflow exposes a set of ...
4 votes
1 answer
285 views

Editing of Insecure Code Examples

I had a discussion with some security experts a few days ago and they said that some content on Stack Overflow is dangerous, because some provided code snippets by other developers will help to evade ...
9 votes
0 answers
94 views

Make share URLs of questions and answers use HTTPS by default or based on loading protocol

I like to visit sites via HTTPS if possible and use HTTPS Everywhere to enforce. I was pretty surprised to see that links that I copied from the "share" box didn't use HTTPS but only HTTP. This could ...
-27 votes
1 answer
322 views

Stack Overflow account security is vulnerable

As Stack Overflow is a worldwide recognized community. I think the account safety of the users should not be compromised. It looks like our Stack Overflow accounts are vulnerable to password hack ...
181 votes
1 answer
5k views

Is email from do-not-reply@stackoverflow.email legit?

I've just received an email from do-not-reply@stackoverflow.email titled Announcing the Stack Overflow Developer Story. Is this a legit email? If so, how come you use this domain while other emails (...
63 votes
1 answer
3k views

adzerk serving ads from adsafeprotected

I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as ...
-3 votes
1 answer
328 views

Is Stack Overflow a secure site? Why is Google Chrome showing a virus icon? [duplicate]

Is it only with me or also with others? When I visit https://stackoverflow.com/questions/ask: I see Google Chrome is showing a virus icon and I was scared. Am I getting any exploits when that icon ...
52 votes
1 answer
2k views

Changing Stack Overflow password does not require the old password

When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old ...
-14 votes
1 answer
322 views

Stack Overflow should check what URL the “ask a question” form is sent from

I discovered a security vulnerability on Stack Overflow. Currently, the server doesn’t check what URL the “ask a question” form is sent from. That means third-party websites are able to “secretly”...
-18 votes
1 answer
102 views

Allow up/downvotes on close/open proposals

It seems as if any five people can go around and start mass-closing questions with enough reputation. What security do we have against this?