4 ms·
> He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, wh
by dan1234 11y ago
> He explained that Disqus offers API services that include "MD5 hashes" of email addresses that allow users to access third-party services such as Gravatar, which in turn permits users to display a consistent avatar across platforms.
Does this mean that other services using Gravatar are also leaking in this way?
- m_eiman 11y agoYes. Docs here: http://sv.gravatar.com/site/implement/hash/ http://sv.gravatar.com/site/implement/hash/
- bentlegen 11y agoSpecifically, the vulnerability discussed was Disqus's use of Gravatar. The "MD5 hash" provided by their API was strictly used to construct a Gravatar URL.
- foxhop 11y agoYes, this is how Gravatar works.