4 ms·
Gravatar leaks data on millions of users
- charcircuit 5y agoYour username and hashed email were already public information if you used gravatar. It would be like complaining that hackernews is leaking my username right now.
- garritfra 5y agoNo, since I only know your username after you reply to this thread.
- charcircuit 5y agoYes, and I understand that my username is public information, so I'm not concerned if someone is able to create a dataset with my name in it.
- garritfra 5y agoBut are you equally not concerned about your email address?
- charcircuit 5y agoIf I attached an email to my profile publically than it's expected that people would be able to look up my email.
- ogogmad 5y agoI didn't realise that my username-email combination was public. I don't remember ever signing up to Gravatar. Why would I do that?
- charcircuit 5y agoYour avatar URL is made up of a hash of your email.
- ogogmad 5y agoThanks! You have to make sure that the hex digits A-F are in lower case, so a-f. It appears that I got my Gravatar account from a Wordpress account I made up ~1 month ago.
- jasonjayr 5y agoIt's all public info, but I think the big leak here is that if you attached multiple email addresses to your gravitar, it'd serve the same icon for each one, and with that data, it could connect all your multiple identities. Also, if a site showed a gravitar along side your posts, and not an email address, folks now have an email address to connect to your posts.
- snorremd 5y agoNot surprised. I even made a privacy preserving proxy plug-in for Coral Talk, a comment system, that would hide the gravatars behind an UUID based parameter [1]. This was quite some time ago. I understand why Gravatar would choose to expose avatars using a hash of an email, but they could have used a more expensive hashing function. [1] https://github.com/snorremd/talk-plugin-gravatar https://github.com/snorremd/talk-plugin-gravatar