Questions tagged [security]

For posts about security issues centered around Stack Overflow. If you think you found a serious security vulnerability, please report it on the Security page found at https://stackexchange.com/about/security. Do not post such reports on Meta!

Filter by
Sorted by
Tagged with
68 votes
6 answers
1k views

Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)

This question (it's an obfuscated JS hack) allowed this user to randomly click the "Run Snippet" which then got his router hacked. Should the Run Snippet option require a minimum reputation to ...
  • 1,972
4 votes
0 answers
114 views

What should I do if I suspect my account have been hacked?

Today when I log in to StackOverflow, I receive a message of Suspicious request. I did a search and I realised that might be caused by the Internet Service Provider assigning me a different IP address....
  • 17.1k
4 votes
2 answers
102 views

Is closing security related questions without an answer a good idea? [duplicate]

After I took the time to answer this question, it got closed as too broad. Some points I couldn't stop wondering: I agree this is Too Broad. I also think this should be closed. What about those ...
  • 4,566
1 vote
0 answers
62 views

Logging on after going to https://stackoverflow.com redirects to http site [duplicate]

If I go to http://stackoverflow.com, then log in using Google, I am redirected to http://stackoverflow.com after I enter my Google credentials. Shouldn't SE sites respect my initial choice, and ...
332 votes
8 answers
6k views

Fixing answers that recommend "chmod 777"

After stumbling upon both a question which mentioned "I did chmod 777"1 and an answer which recommended "do chmod 777" yesterday I did a basic search and found quite a few answers which recommend this ...
user avatar
7 votes
0 answers
226 views

phishing site called stackoverflow.hex1.ru? [duplicate]

When searching on google for SKVideoNode render video sphere it comes up with a Stackoverflow result only from https://stackoverflow.hex1.ru/questions/tagged/scenekit it looks phishy to me. When I ...
  • 1,552
-13 votes
2 answers
422 views

If there was an EMP from the sun would all of Stack Overflow's data be wiped out? [closed]

May be a silly question, but it is not a field of research I know much about. Someone I know seems to have a bit of a paranoia about an "Electro Magnetic Pulse from the sun wiping out all data ...
  • 7,065
3 votes
0 answers
89 views

Why does Stack Overflow not redirect to HTTPS if I am logged in? [duplicate]

I often open Stack Overflow from result of search engine. Unfortunately the search engine, let name it G**g**, set the link to http instead of https. I expect Stack Overflow to redirect to HTTPS ...
  • 3,190
3 votes
0 answers
68 views

Is http://stackflow.info/ anyhow related to Stack Overflow? [duplicate]

I've found this site in Google Search results: http://stackflow.info/ It is related anyhow with Stack Overflow official site? If not, how can I report it to Stack Overflow administrators?
  • 3,107
59 votes
3 answers
3k views

Why does the Stack Overflow login form tell you whether a specific login exists or not?

I've noticed something on the Stack Overflow login page: detecting if an email address has been used by a user for registration is actually possible. In short, when you want to log in with an email ...
  • 5,755
49 votes
1 answer
5k views

"Stackoverflow has been compromised" post

This post (10k+ only) claims that StackOverflow DB have been compromised with a link for a Facebook picture and a download link to a torrent file. This may be nothing but I prefer to ask the question ...
  • 28.8k
1 vote
0 answers
63 views

URL 123qestion.gq points to stack overflow [duplicate]

So this site loads up stack overflow, wondering if anyone knows if this is a potential security issue as I know stackExchange disallows being embedded in an iframe. seems a bit worrying as its ...
16 votes
1 answer
2k views

My Stack Overflow profile's "About Me" section changed

This was a weird message in my Stack Overflow "About me" section and I didn't put it in the section: Flowers for you stackoverflow ..... you don't know who i am ...... i am your flowering god !!!! ...
4 votes
2 answers
199 views

OAuth vulnerability

I signed up for SO (years ago) using my Yahoo account. Today I accidentally signed-in using Facebook and was surprised that I was logged into my existing SO account (the same one created from my Yahoo ...
  • 184k
-17 votes
1 answer
149 views

Security Policies

I get the following message when trying to provide a password I'll actually remember: "Must contain at least 1 more unique character." Let's talk about security in the context of computers, ...
2 votes
0 answers
104 views

What to do with questions asking to break companies'/schools' security rules? [duplicate]

I wonder how this type of question should be treated, as it seems to encourage piracy or security outage? https://stackoverflow.com/questions/31582778/is-there-a-file-that-runs-like-a-batch-file-but-...
  • 24.7k
43 votes
1 answer
3k views

Compromised account or childish "I was there" graffiti?

I just seen this weird answer while doing some reviews: https://stackoverflow.com/a/30735168/317266 [Edit: being that bad, the answer seems to have being rapidly plonked via downscoring] While ...
  • 11k
343 votes
7 answers
29k views

Problematic PHP Cryptography Advice in Popular Questions

Update 2015-07-22: The specific problems listed below have, for the most part, been remedied. More work remains to be done to clean up other instances of insecure code or bad security advice. If ...
5 votes
0 answers
292 views

HTTPs by default [duplicate]

I am not sure how I missed this before, but when navigating to SO or other SE sites, it does not use HTTPs by default. Has this always been the case? Why does the site not redirect to HTTPs ...
14 votes
0 answers
474 views

Site duplicating Stack Overflow, potential privacy/security issue? [duplicate]

I was doing searching on Google for some work I was doing and came across an odd looking Stack Overflow link. http://stackoverflow.com.80bola.com/ (Added it like this so no one accidentally clicks it)...
  • 4,238
9 votes
0 answers
94 views

Make share URLs of questions and answers use HTTPS by default or based on loading protocol

I like to visit sites via HTTPS if possible and use HTTPS Everywhere to enforce. I was pretty surprised to see that links that I copied from the "share" box didn't use HTTPS but only HTTP. This could ...
19 votes
2 answers
1k views

How bad can someone other than me asking a question from my account be?

I discovered yesterday by staring at my asked questions that my main account asked this very poor question. Honestly, I do not recall asking that question, and I do not recall ever working with ...
39 votes
1 answer
584 views

Possible XSS vulnerability on Stack Overflow?

So I was just browsing through the newest node.js questions and I see the layout is all messed up. The question you see has a snippet that starts with a <form> tag: <form action="" method="...
  • 31.3k
2 votes
1 answer
212 views

Password or Email is wrong message at login is insecure

today i have seen a problem with the Stackoverflow login mechanism. At my opinion a service which tells the user: your email is wrong and if the email is correct it says the password is wrong is ...
  • 5,368
126 votes
8 answers
4k views

What would happen if I posted thoughts on how to write a Stack Overflow robot?

I've been mulling recently over how one might go about designing a Stack Overflow robot, to gain as much rep as possible without being detected as a bot. Let me make it very clear that I have no ...
6 votes
2 answers
314 views

Flag posts with security issues

How do we handle questions or answers that include code with severe security issues? Ignoring them is certainly not an option. A similar question has been asked and discussed before; as “Cupcake” ...
  • 12.1k
4 votes
1 answer
379 views

CDN js+css sometimes fails to load over https

Lately I've been continuously experiencing malfunctions of the site when browsing with HTTPS. The urls https://cdn.sstatic.net/Js/stub.en.js?v=178f8ec7cc80 and https://cdn.sstatic.net/stackoverflow/...
  • 614k
3 votes
1 answer
165 views

How to deal with potentially malcious or rather useless links in a question? [duplicate]

Various questions and answers on SO contain links that I would consider useless, or even potentially dangerous. (This is especially true for questions that deal with front-end web development.) There ...
  • 12.1k
0 votes
1 answer
358 views

Is there any policy on Stack Overflow for a situation when a user installs keylogger on another user's computer?

For nearly 3 years on Stack Overflow, I received great/enormous/gigantic amount of help from users. About year and a half after asking question a user openned chat room for me and asked to use ...
  • 17.1k
10 votes
0 answers
596 views

Might my connection to SE sites be MITM'ed?

I have noticed for the past week or so that I'm often surprisingly "logged out" of SO and other SE network sites. Additionally, even when I log in I'm on an HTTP, not HTTPS, connection. When I try to ...
  • 29.5k

1
2