> "2021-12: Gravatar lost 167 million names, usernames and MD5 hashes of email addresses (Source, German Source)" Bad to pick one item and grumble, but I'm goi

> "2021-12: Gravatar lost 167 million names, usernames and MD5 hashes of email addresses (Source, German Source)" Bad to pick one item and grumble, but I'm going to anyway. With Gravatar your identity is the MD5 hash of your email address. Go to any forum which uses Gravatar and look at the URL of avatar image, that blob of text is the MD5 hash of their email. And of course you click to go to the Gravatar profile, and see their username on the forum page. It makes no sense to say they are "lost" or leaked - they are published in normal use. You can then make a few guesses that their email will be some variant of username@gmail.com and that the first part will be nice enough for a human to type, and the second part must be a valid domain - and likely a common domain. So if you think "MD5 is too big to brute force", this is a very restricted input. [At least, this used to be true, I haven't verified if Gravatar have changed anything - but I doubt it because the idea is that you sign up your email address at a new forum and it's magically connected to your Gravatar on another domain, so if it had extra salts and passwords it would lose all its convenience].