Questions tagged [security]
For posts about security issues centered around Stack Overflow. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!
80
questions
6
votes
1
answer
155
views
Is it possible to associate my Stack Overflow account with more than one Google Login?
The company where I work does monitor everything we do by intercepting all HTTPS using proxy.
I do not trust them and moreover I suspect them to monitor all of our activities.
So I prefer to not use ...
21
votes
0
answers
240
views
Adding Security log option for seeing login activites
Recently I was logged out of my SO account automatically. This happened 2 times in 2 days (like 1 today and 1 yesterday). Note also that this has happened in the past as well. Upon seeing this, I am ...
-24
votes
1
answer
267
views
User (well, answerer) security on Stack Overflow [duplicate]
Earlier on I was perusing python questions, when I stumbled over a question - now deleted, asking something along the lines:
How can I access this website with Selenium? Why is the page blank when I ...
20
votes
1
answer
2k
views
Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?
Just wondering if there's a risk to a user's machine by clicking "Run Snippet" in questions like this one
I'm suspicious because on the face of it the question doesn't look like it needs to ...
3
votes
0
answers
72
views
Add an option in Settings to log out of a device that is logged in to your account
If someone is hacked/has a hacker running about in their account or just in general want to sign out on specific devices, having a list of devices currently logged in on the account under My Logins or ...
58
votes
2
answers
18k
views
Adding HTML tags or HTML-tag-like to a title, breaks rendering
This question cannot be rendered.
Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea> or some other tag to the title, as ...
237
votes
4
answers
4k
views
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
A friendly reminder to all those who need it:
Executing code you found online is BAD!!*
Once more for the people in the back:
Executing code you found online is BAD!!!!!*
There's a great post on the ...
67
votes
1
answer
1k
views
Using a personal Stack Overflow account for a Team potentially allows your employer to take it over [closed]
This is based on this support request from fazy about several potential issues due to the fact that SO and Teams account are not separate entities. As this received no response, I tried one of the ...
5
votes
1
answer
225
views
Imgur secure connection failing
I was reviewing this question on Stack Overflow, it has two links to https://i.stack.imgur.com. I'm pretty sure these are images added to the question with the image tool (powered by Imgur) so I ...
20
votes
1
answer
1k
views
What kind of Access Control is used on Stack Overflow?
Recently I have done some research about different Access Control models and policies. My accent was on Role-Based Access Control, and one of the main disadvantages of it is that it is not dynamic (...
13
votes
0
answers
303
views
Breach or very strange coincidence?
It has been too long since I've updated my password on Stack Overflow, so I decided to do so a couple of days ago. I accidentally set it as the same password that I used on an old (forgotten, unused ...
-10
votes
1
answer
146
views
Can I post executable binaries to into Stack Overflow?
I have updated the compiler, and I am struggling to get the binaries generated by the new compiler to work. I figure that besides describing the problem and the command lines involved, it will ...
9
votes
0
answers
103
views
Why does Stack Overflow not use Content-Security-Policy HTTP header to prevent XSS attacks?
OWASP recommends using Content-Security-Policy HTTP header to prevent XSS attacks.
I inspected Stack Overflow HTTP requests in the browser and didn't find any Content-Security-Policy HTTP header.
Why ...
49
votes
1
answer
688
views
Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?
My friend and I were writing a question title on this site, We wanted to use an HTML tag, but we saw to our surprise that the title of the question had interpreted our HTML Tag. I was wondering if ...
12
votes
1
answer
454
views
Does Stack Overflow prevent cartels? [duplicate]
Let's say I organize a group of users (or fake users/bots) with malicious intent to inflate reputation. They will ask questions and upvote each others' answers. To keep things safe, questions will ...
1041
votes
5
answers
33k
views
Embedding Facebook avatars enables tracking of Stack Overflow users
By now, everyone who follows technology should be aware of the scandals around Facebook's ethics and data privacy. Many users distrust them and are uncomfortable with their data collection practices.
...
7
votes
2
answers
276
views
Suspicious Firefox Add-in for Stack Exchange
I saw a recently added Firefox add-in specifically for Stack Overflow, to remove the side-bar links, but it seems suspicious to me.
Maybe I'm being over-paranoid but:
1. Excessive Permissions?
...
85
votes
1
answer
1k
views
Will there be any further updates on the security incident of May 5, 2019?
Stack Overflow had a security incident back in May, in which a small amount of user data was compromised. This received a lot of attention, and the company did a great job communicating their initial ...
2
votes
0
answers
109
views
What is happening with this page? [duplicate]
I don't quite know where to begin with, how to pose this question or even if this is the correct site ...
Spoiler: Beware of the pop-up when clicking the link below.
I found by link on Google Search,...
55
votes
2
answers
976
views
Reassigning window.name inside a Stack Snippet results in unexpected popup
Run the following snippet twice (either in the post proper, or in the snippet editor). On subsequent runs, rather than the form posting to the embedded result iframe, a new window is opened:
...
157
votes
2
answers
1k
views
With Regards to the Security Update
I'm not really sure what's the right avenue to do this so I'll try meta. I promise to take it well if this gets closed or downvoted :]
I just wanted to say thank you for the way you're handling the ...
6
votes
0
answers
212
views
Should questions that contain insecure code be answered?
I frequent the encryption tag on Stack Overflow and, as an individual, am very passionate about security best practices. I often stumble upon questions that implement incredibly insecure code, for ...
106
votes
2
answers
4k
views
What actions have been taken after the data leak reported on Feb 5 2019? [duplicate]
On Feb 5, 2019, a data leak was reported and a Stack Overflow Product Manager admitted to causing it.
We got an "oops, sorry, won't happen again". For some, this is not enough, considering it's not ...
3
votes
0
answers
89
views
Why does Stack Overflow not redirect to HTTPS if I am logged in? [duplicate]
I often open Stack Overflow from result of search engine. Unfortunately the search engine, let name it G**g**, set the link to http instead of https. I expect Stack Overflow to redirect to HTTPS ...
35
votes
1
answer
806
views
Generated <script> contents considered harmful</script> [closed]
An XSS vulnerability and a data validation bug exist in Stack Overflow Teams that can be used together to trigger a XSS against teammates. This isn't very exploitable in practice.
When you are ...
126
votes
1
answer
2k
views
Your team memberships are leaked to other websites [closed]
Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css.
theme.css ...
8
votes
0
answers
151
views
Is my "Comment Evaluator 5000™" campaign email legit? [duplicate]
How do I know a "Comment Evaluator 5000™" email I received is legit?
I mean, I got an email from some weird address (comment-classification@stackoverflow.email), note "stackoverflow.email", not "...
0
votes
1
answer
252
views
How to reduce answers with security issues?
I think security is a big issue on Stack Overflow. There are tons of old answers with bad advice and some with a high amount of upvotes. We already have everything we need to handle bad answers by ...
3
votes
0
answers
68
views
Is http://stackflow.info/ anyhow related to Stack Overflow? [duplicate]
I've found this site in Google Search results: http://stackflow.info/
It is related anyhow with Stack Overflow official site?
If not, how can I report it to Stack Overflow administrators?
14
votes
2
answers
702
views
Suspicious email about the end of OpenID support
I've just received a email from SO titled "ACTION NEEDED: We are deprecating OpenID suppoort".
I haven't used OpenID as the login method for my account if memory serves me right. Besides, the ...
10
votes
1
answer
620
views
What email or MD5 is used for the Gravatar URI?
The URI generated for my Gravatar link contains an unique identifier.
As this is not the MD5 of my email, what is it?
If the MD5 uses somebody else's email, how can I retrieve that?
If something ...
11
votes
0
answers
110
views
Unable to Revoke Applications From Profile
I have been attempting for the last week to temporarily remove some apps that I have provided read/write access to act on behalf of myself, but I am not having any success.
As you can see in the ...
4
votes
0
answers
57
views
Ask before merging data from different credentials [duplicate]
I log to my account with Gmail, and I use my account as anonymous. Once I accidentally logged in with Facebook, and StackOverflow automatically imported my picture and real name.
It didn't ask can it ...
126
votes
8
answers
4k
views
What would happen if I posted thoughts on how to write a Stack Overflow robot?
I've been mulling recently over how one might go about designing a Stack Overflow robot, to gain as much rep as possible without being detected as a bot.
Let me make it very clear that I have no ...
1
vote
0
answers
160
views
stackoverflowr.com proxying stackoverflow.com for phishing? [duplicate]
I came across a clone of stackoverflow.com today coming through Bing searches. Not just content scraping, but a full-on proxy server clone. All the latest content appears on this duplicate site ...
-15
votes
2
answers
236
views
Has SO considered adding facilities for removing or obfuscating sensitive data contained in posts? [duplicate]
Many OPs cut and paste raw text such as code, config files and error messages into their posts. Many overlook passwords, directories, binary meta data and other sensitive information which can ...
6
votes
2
answers
353
views
The Impact of Information Sources on Code Security
According to the highly decorated paper The Impact of Information Sources on Code Security
Internet resources such as Stack Overflow are blamed for promoting insecure solutions that are naively ...
95
votes
6
answers
3k
views
Poorly worded 8-year old question with hundreds of votes and security implications
TL;DR. A question with a title that asks specifically for crypto code, all answerers think it's reasonable to ignore security feedback, specifically because the question is poorly worded. Years in the ...
5
votes
2
answers
2k
views
Why is window.open() blocked?
When I run this code from a server, it works just fine, but it doesn't work in a Stack Snippet:
var wind;
function openWindow() {
wind = window.open("https://www.google.com/", "wind", "...
49
votes
3
answers
2k
views
Is Stack Overflow secure even when not using HTTPS?
I noticed stackoverflow.com doesn't force the use of an HTTPS connection even when the user is logged in.
I've found this question on security.stackexchange.com on "Why is Stack Overflow not using ...
1
vote
0
answers
120
views
Enforce HTTPS at least for certain areas, don’t transmit authentication cookies via HTTP
Come on guys – it’s almost 2017, and Stack Overflow still runs in plain HTTP mode by default (like all of the Stack Exchange sites, BTW). By doing so, Stack Overflow exposes a set of ...
4
votes
1
answer
285
views
Editing of Insecure Code Examples
I had a discussion with some security experts a few days ago and they said that some content on Stack Overflow is dangerous, because some provided code snippets by other developers will help to evade ...
9
votes
0
answers
94
views
Make share URLs of questions and answers use HTTPS by default or based on loading protocol
I like to visit sites via HTTPS if possible and use HTTPS Everywhere to enforce. I was pretty surprised to see that links that I copied from the "share" box didn't use HTTPS but only HTTP.
This could ...
-27
votes
1
answer
322
views
Stack Overflow account security is vulnerable
As Stack Overflow is a worldwide recognized community. I think the account safety of the users should not be compromised.
It looks like our Stack Overflow accounts are vulnerable to password hack ...
181
votes
1
answer
5k
views
Is email from do-not-reply@stackoverflow.email legit?
I've just received an email from do-not-reply@stackoverflow.email titled Announcing the Stack Overflow Developer Story.
Is this a legit email? If so, how come you use this domain while other emails (...
63
votes
1
answer
3k
views
adzerk serving ads from adsafeprotected
I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as ...
-3
votes
1
answer
328
views
Is Stack Overflow a secure site? Why is Google Chrome showing a virus icon? [duplicate]
Is it only with me or also with others?
When I visit https://stackoverflow.com/questions/ask:
I see Google Chrome is showing a virus icon and I was scared. Am I getting any exploits when that icon ...
52
votes
1
answer
2k
views
Changing Stack Overflow password does not require the old password
When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old ...
-14
votes
1
answer
322
views
Stack Overflow should check what URL the “ask a question” form is sent from
I discovered a security vulnerability on Stack Overflow. Currently, the server doesn’t check what URL the “ask a question” form is sent from. That means third-party websites are able to “secretly”...
-18
votes
1
answer
102
views
Allow up/downvotes on close/open proposals
It seems as if any five people can go around and start mass-closing questions with enough reputation.
What security do we have against this?