Questions tagged [security]
For posts about security issues centered around Stack Overflow. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!
80
questions
1041
votes
5
answers
33k
views
Embedding Facebook avatars enables tracking of Stack Overflow users
By now, everyone who follows technology should be aware of the scandals around Facebook's ethics and data privacy. Many users distrust them and are uncomfortable with their data collection practices.
...
343
votes
7
answers
29k
views
Problematic PHP Cryptography Advice in Popular Questions
Update 2015-07-22: The specific problems listed below have, for the most part, been remedied. More work remains to be done to clean up other instances of insecure code or bad security advice.
If ...
332
votes
8
answers
6k
views
Fixing answers that recommend "chmod 777"
After stumbling upon both a question which mentioned "I did chmod 777"1 and an answer which recommended "do chmod 777" yesterday I did a basic search and found quite a few answers which recommend this ...
237
votes
4
answers
4k
views
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
A friendly reminder to all those who need it:
Executing code you found online is BAD!!*
Once more for the people in the back:
Executing code you found online is BAD!!!!!*
There's a great post on the ...
181
votes
1
answer
5k
views
Is email from do-not-reply@stackoverflow.email legit?
I've just received an email from do-not-reply@stackoverflow.email titled Announcing the Stack Overflow Developer Story.
Is this a legit email? If so, how come you use this domain while other emails (...
157
votes
2
answers
1k
views
With Regards to the Security Update
I'm not really sure what's the right avenue to do this so I'll try meta. I promise to take it well if this gets closed or downvoted :]
I just wanted to say thank you for the way you're handling the ...
126
votes
8
answers
4k
views
What would happen if I posted thoughts on how to write a Stack Overflow robot?
I've been mulling recently over how one might go about designing a Stack Overflow robot, to gain as much rep as possible without being detected as a bot.
Let me make it very clear that I have no ...
126
votes
1
answer
2k
views
Your team memberships are leaked to other websites [closed]
Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css.
theme.css ...
114
votes
1
answer
861
views
Globally fixing spam/malware taking advantage of JSBin quirk
I've had this happen on a couple of my old answers using JSBin: I'd done up a quick example and linked to it like this: http://jsbin.com/iyucuy (not marked up as a link on purpose, keep reading). At ...
106
votes
2
answers
4k
views
What actions have been taken after the data leak reported on Feb 5 2019? [duplicate]
On Feb 5, 2019, a data leak was reported and a Stack Overflow Product Manager admitted to causing it.
We got an "oops, sorry, won't happen again". For some, this is not enough, considering it's not ...
95
votes
6
answers
3k
views
Poorly worded 8-year old question with hundreds of votes and security implications
TL;DR. A question with a title that asks specifically for crypto code, all answerers think it's reasonable to ignore security feedback, specifically because the question is poorly worded. Years in the ...
85
votes
1
answer
1k
views
Will there be any further updates on the security incident of May 5, 2019?
Stack Overflow had a security incident back in May, in which a small amount of user data was compromised. This received a lot of attention, and the company did a great job communicating their initial ...
68
votes
6
answers
1k
views
Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)
This question (it's an obfuscated JS hack) allowed this user to randomly click the "Run Snippet" which then got his router hacked.
Should the Run Snippet option require a minimum reputation to ...
67
votes
1
answer
1k
views
Using a personal Stack Overflow account for a Team potentially allows your employer to take it over [closed]
This is based on this support request from fazy about several potential issues due to the fact that SO and Teams account are not separate entities. As this received no response, I tried one of the ...
63
votes
1
answer
3k
views
adzerk serving ads from adsafeprotected
I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as ...
59
votes
3
answers
3k
views
Why does the Stack Overflow login form tell you whether a specific login exists or not?
I've noticed something on the Stack Overflow login page: detecting if an email address has been used by a user for registration is actually possible.
In short, when you want to log in with an email ...
58
votes
2
answers
18k
views
Adding HTML tags or HTML-tag-like to a title, breaks rendering
This question cannot be rendered.
Simple multi-colored textarea based editor
neither on question view, or list view.
The bug is triggered by adding <textarea> or some other tag to the title, as ...
55
votes
2
answers
976
views
Reassigning window.name inside a Stack Snippet results in unexpected popup
Run the following snippet twice (either in the post proper, or in the snippet editor). On subsequent runs, rather than the form posting to the embedded result iframe, a new window is opened:
...
52
votes
1
answer
2k
views
Changing Stack Overflow password does not require the old password
When I change my password on Stack Overflow through my settings, it only requires me to type my new password and repeat my new password, whereas most other websites would require me to type my old ...
49
votes
1
answer
5k
views
"Stackoverflow has been compromised" post
This post (10k+ only) claims that StackOverflow DB have been compromised with a link for a Facebook picture and a download link to a torrent file. This may be nothing but I prefer to ask the question ...
49
votes
3
answers
2k
views
Is Stack Overflow secure even when not using HTTPS?
I noticed stackoverflow.com doesn't force the use of an HTTPS connection even when the user is logged in.
I've found this question on security.stackexchange.com on "Why is Stack Overflow not using ...
49
votes
1
answer
688
views
Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?
My friend and I were writing a question title on this site, We wanted to use an HTML tag, but we saw to our surprise that the title of the question had interpreted our HTML Tag. I was wondering if ...
43
votes
1
answer
3k
views
Compromised account or childish "I was there" graffiti?
I just seen this weird answer while doing some reviews: https://stackoverflow.com/a/30735168/317266
[Edit: being that bad, the answer seems to have being rapidly plonked via downscoring]
While ...
39
votes
1
answer
585
views
Possible XSS vulnerability on Stack Overflow?
So I was just browsing through the newest node.js questions and I see the layout is all messed up.
The question you see has a snippet that starts with a <form> tag:
<form action="" method="...
35
votes
1
answer
806
views
Generated <script> contents considered harmful</script> [closed]
An XSS vulnerability and a data validation bug exist in Stack Overflow Teams that can be used together to trigger a XSS against teammates. This isn't very exploitable in practice.
When you are ...
21
votes
0
answers
240
views
Adding Security log option for seeing login activites
Recently I was logged out of my SO account automatically. This happened 2 times in 2 days (like 1 today and 1 yesterday). Note also that this has happened in the past as well. Upon seeing this, I am ...
20
votes
1
answer
2k
views
Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?
Just wondering if there's a risk to a user's machine by clicking "Run Snippet" in questions like this one
I'm suspicious because on the face of it the question doesn't look like it needs to ...
20
votes
1
answer
1k
views
What kind of Access Control is used on Stack Overflow?
Recently I have done some research about different Access Control models and policies. My accent was on Role-Based Access Control, and one of the main disadvantages of it is that it is not dynamic (...
19
votes
2
answers
1k
views
How bad can someone other than me asking a question from my account be?
I discovered yesterday by staring at my asked questions that my main account asked this very poor question.
Honestly, I do not recall asking that question, and I do not recall ever working with ...
16
votes
1
answer
2k
views
My Stack Overflow profile's "About Me" section changed
This was a weird message in my Stack Overflow "About me" section and I didn't put it in the section:
Flowers for you stackoverflow ..... you don't know who i am ...... i am your flowering god !!!! ...
14
votes
2
answers
702
views
Suspicious email about the end of OpenID support
I've just received a email from SO titled "ACTION NEEDED: We are deprecating OpenID suppoort".
I haven't used OpenID as the login method for my account if memory serves me right. Besides, the ...
14
votes
0
answers
474
views
Site duplicating Stack Overflow, potential privacy/security issue? [duplicate]
I was doing searching on Google for some work I was doing and came across an odd looking Stack Overflow link.
http://stackoverflow.com.80bola.com/
(Added it like this so no one accidentally clicks it)...
13
votes
0
answers
303
views
Breach or very strange coincidence?
It has been too long since I've updated my password on Stack Overflow, so I decided to do so a couple of days ago. I accidentally set it as the same password that I used on an old (forgotten, unused ...
12
votes
1
answer
454
views
Does Stack Overflow prevent cartels? [duplicate]
Let's say I organize a group of users (or fake users/bots) with malicious intent to inflate reputation. They will ask questions and upvote each others' answers. To keep things safe, questions will ...
11
votes
0
answers
110
views
Unable to Revoke Applications From Profile
I have been attempting for the last week to temporarily remove some apps that I have provided read/write access to act on behalf of myself, but I am not having any success.
As you can see in the ...
10
votes
1
answer
620
views
What email or MD5 is used for the Gravatar URI?
The URI generated for my Gravatar link contains an unique identifier.
As this is not the MD5 of my email, what is it?
If the MD5 uses somebody else's email, how can I retrieve that?
If something ...
10
votes
0
answers
596
views
Might my connection to SE sites be MITM'ed?
I have noticed for the past week or so that I'm often surprisingly "logged out" of SO and other SE network sites.
Additionally, even when I log in I'm on an HTTP, not HTTPS, connection. When I try to ...
9
votes
0
answers
103
views
Why does Stack Overflow not use Content-Security-Policy HTTP header to prevent XSS attacks?
OWASP recommends using Content-Security-Policy HTTP header to prevent XSS attacks.
I inspected Stack Overflow HTTP requests in the browser and didn't find any Content-Security-Policy HTTP header.
Why ...
9
votes
0
answers
94
views
Make share URLs of questions and answers use HTTPS by default or based on loading protocol
I like to visit sites via HTTPS if possible and use HTTPS Everywhere to enforce. I was pretty surprised to see that links that I copied from the "share" box didn't use HTTPS but only HTTP.
This could ...
8
votes
0
answers
151
views
Is my "Comment Evaluator 5000™" campaign email legit? [duplicate]
How do I know a "Comment Evaluator 5000™" email I received is legit?
I mean, I got an email from some weird address (comment-classification@stackoverflow.email), note "stackoverflow.email", not "...
7
votes
2
answers
276
views
Suspicious Firefox Add-in for Stack Exchange
I saw a recently added Firefox add-in specifically for Stack Overflow, to remove the side-bar links, but it seems suspicious to me.
Maybe I'm being over-paranoid but:
1. Excessive Permissions?
...
7
votes
0
answers
226
views
phishing site called stackoverflow.hex1.ru? [duplicate]
When searching on google for SKVideoNode render video sphere it comes up with a Stackoverflow result only from https://stackoverflow.hex1.ru/questions/tagged/scenekit
it looks phishy to me.
When I ...
6
votes
2
answers
353
views
The Impact of Information Sources on Code Security
According to the highly decorated paper The Impact of Information Sources on Code Security
Internet resources such as Stack Overflow are blamed for promoting insecure solutions that are naively ...
6
votes
2
answers
314
views
Flag posts with security issues
How do we handle questions or answers that include code with severe security issues? Ignoring them is certainly not an option.
A similar question has been asked and discussed before; as “Cupcake” ...
6
votes
1
answer
155
views
Is it possible to associate my Stack Overflow account with more than one Google Login?
The company where I work does monitor everything we do by intercepting all HTTPS using proxy.
I do not trust them and moreover I suspect them to monitor all of our activities.
So I prefer to not use ...
6
votes
0
answers
212
views
Should questions that contain insecure code be answered?
I frequent the encryption tag on Stack Overflow and, as an individual, am very passionate about security best practices. I often stumble upon questions that implement incredibly insecure code, for ...
5
votes
2
answers
2k
views
Why is window.open() blocked?
When I run this code from a server, it works just fine, but it doesn't work in a Stack Snippet:
var wind;
function openWindow() {
wind = window.open("https://www.google.com/", "wind", "...
5
votes
1
answer
225
views
Imgur secure connection failing
I was reviewing this question on Stack Overflow, it has two links to https://i.stack.imgur.com. I'm pretty sure these are images added to the question with the image tool (powered by Imgur) so I ...
5
votes
0
answers
292
views
HTTPs by default [duplicate]
I am not sure how I missed this before, but when navigating to SO or other SE sites, it does not use HTTPs by default. Has this always been the case?
Why does the site not redirect to HTTPs ...
4
votes
2
answers
200
views
OAuth vulnerability
I signed up for SO (years ago) using my Yahoo account. Today I accidentally signed-in using Facebook and was surprised that I was logged into my existing SO account (the same one created from my Yahoo ...