186
votes
Accepted
Is email from [email protected] legit?
Yes it is legit. We use it to protect stackoverflow.com user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email subdomain, CNAMEd to a third party service we ...
74
votes
Accepted
Adding HTML tags or HTML-tag-like to a title, breaks rendering
The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide).
The vulnerability was on the ...
59
votes
Accepted
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
We should totally add a warning popup that appears whenever someone is copying code. You know, like this:
The Learn more button should link to this meta thread, or the blog post. You may dismiss the ...
57
votes
Embedding Facebook avatars enables tracking of Stack Overflow users
Firefox has an answer in terms of containers, sandboxing a group of URLs so their cookies remain within that group/container.
There is an official extension available that lets you create custom ...
54
votes
Accepted
Is Stack Overflow secure even when not using HTTPS?
No, there are a number of things about the http connection that are not secure.
Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
48
votes
Accepted
Your team memberships are leaked to other websites
We've applied a tweak that should mitigate against this, thanks.
when I am in fact a member of several teams (actual names redacted):
43
votes
Accepted
Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?
At the moment, Stack Snippets are, to the best knowledge of experts who've considered the problem (both SE employees and standard users like ourselves), completely sandboxed and pretty safe to run. ...
40
votes
Embedding Facebook avatars enables tracking of Stack Overflow users
"Stack Overflow directly links to profile pictures from Facebook, which allows Stack Overflow users to be tracked by Facebook - even if we don't have a Facebook account."
First paragraph of the ...
37
votes
Accepted
Poorly worded 8-year old question with hundreds of votes and security implications
I think some judicious editing would go a long way here.
My first suggestion would be editing the question, especially the title. If you re-paint the search target so that it's square and turquoise ...
37
votes
Accepted
Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?
Thanks for the heads-up! This is now fixed:
30
votes
What actions have been taken after the data leak reported on Feb 5 2019?
We got an "oops, sorry, won't happen again"
That's an unfair and inaccurate way to present Anita's answer. They answered with transparency, did not try to bail out of responsibility, and exposed what ...
25
votes
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
I think the comments on the questions should be addressed:
This is malware. You can go take a flying leap.
This is trolling.
Malware: yes, this would probably qualify as malicious software. Abuse ...
24
votes
What kind of Access Control is used on Stack Overflow?
I don't know the answer to your question about Stack Overflow specifically, but I wanted to respond to another part of what you said: "one of the main disadvantages of it is that it is not ...
22
votes
Poorly worded 8-year old question with hundreds of votes and security implications
Even if the answers were justified by the poor wording of the question, it seems to me that would just be reason to improve both the question and the answer(s). The purpose of Stack Overflow isn't to ...
20
votes
With Regards to the Security Update
I do have a minor quibble with this (and I do mean minor), but it does need saying
Security Update
If someone were to ask a question entitled that anywhere on SO/SE, it would be edited or closed. ...
MachavityMod
- 31.6k
19
votes
Adding HTML tags or HTML-tag-like to a title, breaks rendering
It appears that it included script tags as well. I was able to snap this screenshot at 2021-09-01T10:41:16Z before it was fixed:
19
votes
User (well, answerer) security on Stack Overflow
Let me start with saying that a comment that states:
I asked the user what he was trying to do with that page, collect users' IP addresses or something.
is unfriendly, if not harassment and that ...
18
votes
Stack Overflow account security is vulnerable
Stack Exchange is already covered as far as "Brute-force" attacks go:
I got this verification request after only 3 phoney (manual) login attempts using Stack Overflow's own login option.
I'm sure ...
17
votes
The Impact of Information Sources on Code Security
No, we don't have to change a thing. The developer copying and pasting code blindly from here, or the company that permits that thing to happen, is the entity that needs to change.
The article ...
17
votes
Poorly worded 8-year old question with hundreds of votes and security implications
Related:
Sample code within questions about cryptography / encryption
Editing of Insecure Code Examples
Flag posts with security issues
How to Warn of Serious Issues in Code Unrelated to Question?
...
16
votes
Accepted
Suspicious email about the end of OpenID support
Yes, there is a legitimate email going out to all users with OpenID credentials attached to their account that will be expiring and will lock them out of their account.
You previously only ever used ...
15
votes
Accepted
Why is window.open() blocked?
Security.
The moment you allow a window from a different domain to open, it gets access to the parent window and details about the parent page and can change the parent page.
14
votes
Is Stack Overflow secure even when not using HTTPS?
The best that we know about is that it's still in progress. Here's a similar question on Meta Stack Exchange which has some details.
To answer your specific questions...
Your login is secured ...
14
votes
Has SO considered adding facilities for removing or obfuscating sensitive data contained in posts?
As others have pointed out, moderators currently have the ability to manually redact portions of a post to remove sensitive information. It requires two moderators to turn the key, because such ...
13
votes
Poorly worded 8-year old question with hundreds of votes and security implications
I would argue that keeping posts with bad advice around is really harmful, at any rate. The question and its answers have to go.
I propose the following way of achieving this:
Get some crypto-...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
security × 82discussion × 37
support × 20
bug × 16
feature-request × 14
status-completed × 10
ssl × 7
privacy × 7
answers × 4
stack-snippets × 4
login × 4
stack-overflow-for-teams × 3
accounts × 3
reputation × 2
status-bydesign × 2
spam × 2
moderation × 2
advertising × 2
privileges × 2
email × 2
merge-accounts × 2
ethics × 2
copycat-sites × 2
logout × 2
specific-question × 1