11 ms·

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons l

Serious question: what sensitive user data is there on Stack Overflow anyway? Questions, answers and comments are all public, the content is Creative Commons licensed and even available in handy downloadable & queryable form: https://data.stackexchange.com/ https://data.stackexchange.com/ As far as I can see, the primary sensitive user data they have is e-mail addresses, but (unlike, say, Reddit) most StackExchange forums don't deal with personally embarrassing material and many of if not most StackExchange users post with handles easily associated to their real names.

smelendez 7y ago
And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.
- 9nGQluzmnq3M 7y ago
  I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.
  - rcfox 7y ago
    10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons? https://blog.codinghorror.com/i-just-logged-in-as-you-how-it-happened/ https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...
    - 0xffff2 7y ago
      Unless I'm badly misreading something, the unsalted hashes in that post were on some other (unspecified) site unrelated to Stack Overflow.
      - rcfox 7y ago
        In the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow. > I found what one could call a security hole in Stackoverflow. I'm curious enough to go digging around for holes, but too ethical to actually do anything with them.
        0xffff2 7y ago
        I hate to say this, but did you even read the post you actually linked? From the second post (the one you linked), where Jeff quotes the hacker: >>I guess I can tell you, so you don't fall into this trap again. There's a site I help out with that doesn't salt their passwords. They're MD5 encrypted, but if you've got a dictionary password, it's very easy to use a reverse-MD5 site to get the original. I was able to figure out you were a user on the site some time back, and realized I could do this, if only I knew your openid provider... The "password vulnerability involving unsalted hashes" was on another site. The hacker was only able to gain access to Jeff's Stack Overflow account through a combination of their privileged access to the database for that other site and Jeff's own bad op-sec. The only real security error attributable to Stack Overflow in any way was Jeff's own and had nothing to do with Stack Overflow's infrastructure.
  - robomc 7y ago
    They don't have to store them as plain text for it to be a problem. If they're not salted it's trivial to crack the hashes, and if they are all uniquely salted, while it's time consuming, they can still gradually crack them. Given that you could probably sift through the users to find particularly juicy targets (usernames of maintainers of top open source projects with github repos for example?) that could justify the work of a time consuming attack on the hashes.
    - bigiain 7y ago
      Also "Some level of production access" could easily include the ability for the attacker to intercept and exfiltrate passwords as users log in.
    - adrianN 7y ago
      I haven't checked in a while, what's the cost of cracking a single salted password that is stored properly, e.g. with pbkdf2 or bcrypt or whatever is currently state of the art?
      - lucb1e 7y ago
        The cost? That depends on the password. How long does it take to crack 123456? That depends on the parameters. In a good case, it takes 50ms per hash on a modern system, so that's 20 attempts per second (instead of 20 billion per second for a plain md5 or so). I don't really expect a popular site to do much more than that, so that's the best case. From experience, most sites will be more around the 20 billion mark than the 20 mark, but I expect stackoverflow to be on the good end. The current state of the art is Argon2, with scrypt second and bcrypt/pbkdf2 tied for third. The first two have memory hardness, and the first one is the standard chosen in the password hashing algorithm competition. The third is still acceptable because most developers still go for a salted single hash like sha256. Somehow they got the salting method, but I'd rather they break all identical passwords at the same time (they weren't that strong anyway if they're shared between more than one person) than that they crack only a tiny percentage because of the cost. Slowness helps more than salting, yet as a pentester I see more of the latter than the former. So I'd rather recommend something available for their platform as a good third choice than them going "meh, effort" and not implementing the recommendation.
  - bredren 7y ago
    I work on an enterprise infosec tool that just demonstrated 48 trillion MD5s per second using AWS GPUs. Hashed passwords are cracked so easily it is a minor obstacle at this point. It is a question of when not if a hash table is fully cracked.
    - dhritzkiv 7y ago
      MD5 is one thing as a password can be retrieved from a hash table. But pulling out passwords from a hashed + salted value (e.g. via bcrypt) is many orders of magnitude more infeasible, no?
      - bredren 7y ago
        I would be impressed if SO's user password table is in bcrypt.
        dhritzkiv 7y ago
        What makes you say that? bcrypt's been the defacto best practice for user password "storage" for probably 10 years now. MD5's been known to be inadequate for much longer. Even if they had a legacy implementation in MD5, gradually migrating from storing MD5 hashes to storing bcrypt hashes is trivial to do.
        bredren 7y ago
        From what I understand, many systems do not choose to implement strong hashing algos.
        cyphar 7y ago
        Even PHP's hash_function uses scrypt. Yes, some people explicitly decide to hash everything with sha1 but nothing you or I do will ever be able to stop them.
        gpvos 7y ago
        I would be disappointed if such a high-profile and technically savvy site would be using anything less.
- blablabla123 7y ago
  ...unless you use Google login or so. It's almost as if there is nothing to get by hacking SO. That's actually really good engineering.
Sea_Wulf 7y ago
If Stack Overflow's enterprise knowledge management systems were breached then that could potentially be a big deal. A release of knowledge on development and production systems from companies could potentially lead to larger hacks in the future. Of course, that is all speculative until the extent of the breach is released. From the press release, they seem to imply that the only affected areas were public facing.
- smitop 7y ago
  Stack Overflow Enterprise is either self hosted or hosted by SO, but on a individual Azure server instance, so each instance would probably need to be compromised individually. SO will probably release an update for Enterprise customers that scans server logs to check if that Enterprise customer was affected.
paxys 7y ago
Not all of Stack Overflow is public. E.g. https://stackoverflow.com/teams https://stackoverflow.com/teams.
taspeotis 7y ago
I've seen plenty of questions that include API keys or credentials and they're later edited to "remove" them although the revision history is still there. It would make up a minority of content on Stack Overflow but it's still there.
- 9nGQluzmnq3M 7y ago
  Old revisions are already included in the public data dump: https://meta.stackexchange.com/questions/2677/database-schema-documentation-for-the-public-data-dump-and-sede/2678#2678 https://meta.stackexchange.com/questions/2677/database-schem...
sansnomme 7y ago
Emails can be sensitive if they are corporate and patent trolls are the buyers.
- mehrdadn 7y ago
  They can also be sensitive for people who ask rather personal questions on the site...
  - wodny 7y ago
    Or even worse - someone could steal my identity and start answering to JavaScript questions just to frame me.
    - mehrdadn 7y ago
      I assume this is a joke? I was being serious in my comment -- and I was referring to other StackExchange sites, not StackOverflow.
stetrain 7y ago
They have job listings, information about listings I have applied to, and a copy of my resume with contact information.
- chii 7y ago
  Job listings are public information, your resume may also be considered public info if you have sent it out to recruiters or public job posting sites. Listings you've applied to could be potentially private. But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either!
  - dagenix 7y ago
    > But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?
    - chii 7y ago
      i use an alias on stackoverflow, and i use an alias here on HN! My google profile is also an alias. My facebook profile is also an alias. My twitter, same. And if i had a linked-in profile, it would be an alias too. Some of those alias may be the same, but some i deliberately make different, so that i can choose whether others can associate different aliases together as the same person. Why anyone puts their real name online is beyond me. When i tell my real life friends, they are shocked, and also ask whether it's inconvenient. Yes, i would answer - it is inconvenient, but it is more control. It gives you the option to prevent others from being able to track all my activities online across different services (at least, not easily).
      - markholmes 7y ago
        What do you mean by alias? Do you apply to jobs as “chii” or as an assumed name, like “John Smith”, when really your name is “Bob Jones”?
mehrdadn 7y ago
Downvotes are also private. They're probably not that valuable of an asset for either side, but I can imagine unpleasant situations here and there if they happened to get leaked.
darklajid 7y ago
Maybe .. the careers/jobs part in particular?
hkjayakumar 7y ago
Possibly StackOverflow Careers data?
IloveHN84 7y ago
Passwords that might be similar to other services and then try to access those services as well. And also all the metadata associated to user's activity
cs02rm0 7y ago
Email addresses do a better job of identifying particular individuals in bulk data than a name field in a variable format. It's a very short hop from email to link technologies from this dataset to place of work and then potential attack routes for a sufficiently capable actor.
amelius 7y ago
All the ads you have clicked on?

smelendez 7y ago

And passwords. In particular, probably some people reuse passwords between Stack Overflow and GitHub, and keep other credentials in files in private repos.

9nGQluzmnq3M 7y ago
I would like to hope Stack Overflow of all companies doesn't store passwords in plaintext, but you never know.
- rcfox 7y ago
  10 years ago, almost to the day, they had a password vulnerability involving unsalted hashes. So not plain text, but who knows if they've learned the right lessons? https://blog.codinghorror.com/i-just-logged-in-as-you-how-it-happened/ https://blog.codinghorror.com/i-just-logged-in-as-you-how-it...
  - 0xffff2 7y ago
    Unless I'm badly misreading something, the unsalted hashes in that post were on some other (unspecified) site unrelated to Stack Overflow.
    - rcfox 7y ago
      In the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow. > I found what one could call a security hole in Stackoverflow. I'm curious enough to go digging around for holes, but too ethical to actually do anything with them.
      - 0xffff2 7y ago
        I hate to say this, but did you even read the post you actually linked? From the second post (the one you linked), where Jeff quotes the hacker: >>I guess I can tell you, so you don't fall into this trap again. There's a site I help out with that doesn't salt their passwords. They're MD5 encrypted, but if you've got a dictionary password, it's very easy to use a reverse-MD5 site to get the original. I was able to figure out you were a user on the site some time back, and realized I could do this, if only I knew your openid provider... The "password vulnerability involving unsalted hashes" was on another site. The hacker was only able to gain access to Jeff's Stack Overflow account through a combination of their privileged access to the database for that other site and Jeff's own bad op-sec. The only real security error attributable to Stack Overflow in any way was Jeff's own and had nothing to do with Stack Overflow's infrastructure.
- robomc 7y ago
  They don't have to store them as plain text for it to be a problem. If they're not salted it's trivial to crack the hashes, and if they are all uniquely salted, while it's time consuming, they can still gradually crack them. Given that you could probably sift through the users to find particularly juicy targets (usernames of maintainers of top open source projects with github repos for example?) that could justify the work of a time consuming attack on the hashes.
  - bigiain 7y ago
    Also "Some level of production access" could easily include the ability for the attacker to intercept and exfiltrate passwords as users log in.
  - adrianN 7y ago
    I haven't checked in a while, what's the cost of cracking a single salted password that is stored properly, e.g. with pbkdf2 or bcrypt or whatever is currently state of the art?
    - lucb1e 7y ago
      The cost? That depends on the password. How long does it take to crack 123456? That depends on the parameters. In a good case, it takes 50ms per hash on a modern system, so that's 20 attempts per second (instead of 20 billion per second for a plain md5 or so). I don't really expect a popular site to do much more than that, so that's the best case. From experience, most sites will be more around the 20 billion mark than the 20 mark, but I expect stackoverflow to be on the good end. The current state of the art is Argon2, with scrypt second and bcrypt/pbkdf2 tied for third. The first two have memory hardness, and the first one is the standard chosen in the password hashing algorithm competition. The third is still acceptable because most developers still go for a salted single hash like sha256. Somehow they got the salting method, but I'd rather they break all identical passwords at the same time (they weren't that strong anyway if they're shared between more than one person) than that they crack only a tiny percentage because of the cost. Slowness helps more than salting, yet as a pentester I see more of the latter than the former. So I'd rather recommend something available for their platform as a good third choice than them going "meh, effort" and not implementing the recommendation.
- bredren 7y ago
  I work on an enterprise infosec tool that just demonstrated 48 trillion MD5s per second using AWS GPUs. Hashed passwords are cracked so easily it is a minor obstacle at this point. It is a question of when not if a hash table is fully cracked.
  - dhritzkiv 7y ago
    MD5 is one thing as a password can be retrieved from a hash table. But pulling out passwords from a hashed + salted value (e.g. via bcrypt) is many orders of magnitude more infeasible, no?
    - bredren 7y ago
      I would be impressed if SO's user password table is in bcrypt.
      - dhritzkiv 7y ago
        What makes you say that? bcrypt's been the defacto best practice for user password "storage" for probably 10 years now. MD5's been known to be inadequate for much longer. Even if they had a legacy implementation in MD5, gradually migrating from storing MD5 hashes to storing bcrypt hashes is trivial to do.
        bredren 7y ago
        From what I understand, many systems do not choose to implement strong hashing algos.
        cyphar 7y ago
        Even PHP's hash_function uses scrypt. Yes, some people explicitly decide to hash everything with sha1 but nothing you or I do will ever be able to stop them.
      - gpvos 7y ago
        I would be disappointed if such a high-profile and technically savvy site would be using anything less.
blablabla123 7y ago
...unless you use Google login or so. It's almost as if there is nothing to get by hacking SO. That's actually really good engineering.

Sea_Wulf 7y ago

If Stack Overflow's enterprise knowledge management systems were breached then that could potentially be a big deal. A release of knowledge on development and production systems from companies could potentially lead to larger hacks in the future. Of course, that is all speculative until the extent of the breach is released. From the press release, they seem to imply that the only affected areas were public facing.

smitop 7y ago
Stack Overflow Enterprise is either self hosted or hosted by SO, but on a individual Azure server instance, so each instance would probably need to be compromised individually. SO will probably release an update for Enterprise customers that scans server logs to check if that Enterprise customer was affected.

paxys 7y ago

Not all of Stack Overflow is public. E.g. https://stackoverflow.com/teams https://stackoverflow.com/teams.

taspeotis 7y ago

I've seen plenty of questions that include API keys or credentials and they're later edited to "remove" them although the revision history is still there. It would make up a minority of content on Stack Overflow but it's still there.

9nGQluzmnq3M 7y ago
Old revisions are already included in the public data dump: https://meta.stackexchange.com/questions/2677/database-schema-documentation-for-the-public-data-dump-and-sede/2678#2678 https://meta.stackexchange.com/questions/2677/database-schem...

sansnomme 7y ago

Emails can be sensitive if they are corporate and patent trolls are the buyers.

mehrdadn 7y ago
They can also be sensitive for people who ask rather personal questions on the site...
- wodny 7y ago
  Or even worse - someone could steal my identity and start answering to JavaScript questions just to frame me.
  - mehrdadn 7y ago
    I assume this is a joke? I was being serious in my comment -- and I was referring to other StackExchange sites, not StackOverflow.

stetrain 7y ago

They have job listings, information about listings I have applied to, and a copy of my resume with contact information.

chii 7y ago
Job listings are public information, your resume may also be considered public info if you have sent it out to recruiters or public job posting sites. Listings you've applied to could be potentially private. But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either!
- dagenix 7y ago
  > But if you use an alias (and only reveal your real name after the company agrees to interview you), then it's not a problem either! Do you do that? Do you know anyone that does? If so, how do people react to it?
  - chii 7y ago
    i use an alias on stackoverflow, and i use an alias here on HN! My google profile is also an alias. My facebook profile is also an alias. My twitter, same. And if i had a linked-in profile, it would be an alias too. Some of those alias may be the same, but some i deliberately make different, so that i can choose whether others can associate different aliases together as the same person. Why anyone puts their real name online is beyond me. When i tell my real life friends, they are shocked, and also ask whether it's inconvenient. Yes, i would answer - it is inconvenient, but it is more control. It gives you the option to prevent others from being able to track all my activities online across different services (at least, not easily).
    - markholmes 7y ago
      What do you mean by alias? Do you apply to jobs as “chii” or as an assumed name, like “John Smith”, when really your name is “Bob Jones”?

mehrdadn 7y ago

Downvotes are also private. They're probably not that valuable of an asset for either side, but I can imagine unpleasant situations here and there if they happened to get leaked.

darklajid 7y ago

Maybe .. the careers/jobs part in particular?

hkjayakumar 7y ago

Possibly StackOverflow Careers data?

IloveHN84 7y ago

Passwords that might be similar to other services and then try to access those services as well. And also all the metadata associated to user's activity

cs02rm0 7y ago

Email addresses do a better job of identifying particular individuals in bulk data than a name field in a variable format. It's a very short hop from email to link technologies from this dataset to place of work and then potential attack routes for a sufficiently capable actor.

amelius 7y ago

All the ads you have clicked on?