7 ms·
Gravatars: why publishing your email's hash is not a good idea
- jrockway 17y agoSo? Sending email is free; you can just send the email without knowing if the address is correct or not. Change the "| md5sum" to "| xargs mail" and you don't need the Gravatar hash anymore.
- sysk 17y agoYou beat me to it.
- mseebach 17y agoIt's not for spam, it's for privacy. Entering your email in a field that says "will not be published", and they generates an avatar, actually party publishes your email address, which is bad for privacy. Say, you suspect that Alice on stack overflow bad-mouthing software vendor "HAL", claiming impartiality, is really Eve, working for competing software vendor "Moon", you might be able to confirm that by using your knowledge of moon.com e-mail addresses, and checking the hash of eve@moon.com, causing SO to breach the privacy Alice/Eve expected when signing up.
- rogeriopvl 17y agoIf I now that someone is called John Doe the result space is almost the same with or without gravatar's hash. It's nothing a brute force attack can't handle.
- youngian 17y agoEither Alice on stack overflow is tying her profile there to her real-world identity, or she shouldn't be signed up for Gravatar. The whole point of Gravatar is to persist a single identity across multiple sites, so I cannot imagine why you would tie a secret or fake identity to a real identity (your email) that you did not want associated with it. Technically, yes, this article is correct. The Gravatar FAQ even discusses this issue, IIRC. But in practical usage, I can't imagine how this would prove important.
- nzmsv 17y agoAn idea for a quick fix: use my.address+really_long_random_string@famousprovider.com as your Gravatar e-mail. Will work if famousprovider==gmail at least.
- blasdel 17y agoDoes that actually work with Gravatar and the blogapp plugins that call it? A ton of people validate addresses using Regular Expressions but don't have the fortitude to copy-paste the monster regex needed to do it correctly.
- westi 17y agoThis will work fine with gravatar. You just have to associate the + address with your account - you can even give it a different image so you could have a different identity on every site without needing multiple email addresses.
- ChadB 17y agoThe big problem with that is that you'd have to use the same really_long_random_string to register for every gravatar-enabled site you want to register for. The only benefit I can see of this is that you could easily blacklist emails destined for that address.
- pyre 17y agoDoesn't have to be a really long and random string. Just has to be something that can't be easily deduced from your name and/or username. This might not defeat rainbow tables, but I think there are probably easier ways to harvest email addresses than to generate rainbow tables and troll for gravatar URLs.
- ars 17y agoIt would also have to be your email on every service you register with, since they use your email automatically to get a gravatar.
- natrius 17y agoSpam hasn't been a problem for me for quite some time. I stopped obfuscating my email address years ago.
- gojomo 17y agoWhat works for you? How often and how closely do your check your spam folder(s) for false-positives?
- novum 17y agoI read over every single spam (or at least the subject and first few lines of the body, via gmail) before deleting. Yes, it's a lot. And yes, as Batsu said, I'm numb to the pain.
- gojomo 17y agoI would consider that level of effort (and numbness) a "problem"; I'm especially curious how "no problem" natrius deals.
- wlievens 17y agoHow many do you get per day? I get about fifty.
- nomoresecrets 17y agoWhen I check my GMail spam folder, I get spams at about the rate of one per minute these days. Filtering those manually became unworkable for me years ago. I maybe see a spam in my inbox once a day. It goes up and down, as spammers find workarounds and then Google fix them. The email address I use is 10+ years old though.
- dflock 17y agoI use Gmail to aggregate all my mailboxes. Gmail's spam folder keeps things for 30 days before deleting them. I've currently got 2965 spam emails in the spam folder - which is a little on the low side of my average. So, I get about 3000 spam emails in 30 days, or about 100 per day. Gmail's spam filtering is almost 100% effective, for me. I see maybe one, occasionally two, spam emails in my inbox per month, and have had maybe 3 false positives over the last couple of years. I very occasionally glance at the contents of the first page of the spam folder, just to be on the safe side, but like I said, I almost never find anything mis-filtered. For me this is good enough - I'm effectively shielded from all spam and don't really notice it as an issue.
- blasdel 17y agoNo matter how inept your accidental data leakage, you can usually rely on Dave Winer to have done a worse job earlier: http://www.metafilter.com/8140/ http://www.metafilter.com/8140/
- jwr 17y agoI don't see what the problem is. My E-mail address is a public piece of information.
- warp 17y agoIt also allows you to match an e-mail address to a particular account. So, let's say a dating site uses gravatars, now anyone who can see those can match my dating profile to my stackoverflow account (and any other site using gravatars). I know this ofcourse, and will use a different e-mail address if I need to keep these identities seperate, but many people do not realize any gravatar enabled user profile can be linked to any other gravatar enabled user profile with only a tiny bit of effort in harvesting.
- ryanelkins 17y agoUh, can't they also link those accounts by noticing that they are the exact same picture? I mean, I thought that was partially the point.
- warp 17y agoThe problem is they can match these profiles even if you haven't signed up for gravatar at all. Your email hash is always sent to gravatar.com.
- nostrademons 17y agoThis is basically a dictionary attack on your e-mail address. There's an easy solution: don't use an easily guessable e-mail address. If you do use an easily guessable e-mail address, Google has been pretty darn good at finding e-mail addresses for years. I could Google various permutations of a username and famous e-mail providers in far less time than it takes to write a Haskell program. (It'd be even easier if Google indexed the @ token...hmm, I wonder if I should be codesearching for e-mail addresses instead.) And if all you want is a list of e-mail addresses, you could just run a crawler and a few regexps, and you'll find way more than 8500 in a few hours.
- tjogin 17y agoNothing will stop people from simply emailing that address without checking/guessing if it exists first. The whole subject of this post is an exercise in futility.
- IgorPartola 17y agoThe goal here is not to find out if an e-mail address is valid. It's to find out if the guy that leaked inside information on an Apple fansite is an Apple employee. It's an issue of privacy, not spam.
- tjogin 17y agoOh, right.
- ryanelkins 17y agoMaybe if the apple employee doesn't want to get caught he shouldn't use his apple.com email address that has his real photo as his gravatar. "Who leaked this info?" "I don't know but it's someone who looks just like Bill! They even use the same gravatar image he uses everywhere else! Devious bastards! Let's see if we can reverse engineer this email hash to find out who this rogue might be!"
- IgorPartola 17y ago
- warp 17y agoI also did some experiments and wrote about this back in april, for anyone interested: http://320x200.org/post.py/2009/gravatar.txt http://320x200.org/post.py/2009/gravatar.txt
- bartl 17y agoIs this guy overly paranoid, or am I overly lax, that I don't care? My email address is all over the internet. So what.
- Aschwin 17y agoI don't get it. Why doesn't Gravatar use a salt to generate the checksum? The salt would only be known to Gravatar and is not bruteforcable by anyone who doesn't know the salt. - Unomi -
- petsos 17y agoBecause then the sites would not be able to generate the hash themselves.
- mattwdelong 17y agoA simple solution would be to assign each website its own unique ID, the based on that UID assign a private/secure salt only known to the website + gravatar. Then when the websites generate hashes, they can then append the salt and generate the hash. Simple solution and seemingly easy to implement..though, it`s probably not. (I suggest this in the event that it really is a big issue. However, I am of the opinion that it`s not)
- lincolnq 17y agoThat would require a bit more infrastructure on Gravatar's part (a UI for registering a site), and would significantly slow its adoption because site owners would have to go register their site before they could generate gravatar URLs. I used Gravatar for my site because it was so easy to implement, and I probably wouldn't have bothered if it was an annoying process like this.
- mbreese 17y agoDing Ding Ding! We have a winner! When I first read the article, I thought the same thing. If each site had their own salt key (probably based upon a id), then this problem goes away. It could get even easier if the domain name captured via the http referrer was used as the salt, then Gravatar.com wouldn't even need a UI to let sites sign up. This might make it a little more difficult for a site operator though, so ideally this would be a configurable option.
- IgorPartola 17y agoJust host your own avatar and OpenID service. That's what I do. Of course a bunch of my info is listed in the whois for the domain so this is moot anyways.
- Gmo 17y agoOff-topic, but what solution do you use for your OpenID service ?
- IgorPartola 17y agohttp://siege.org/projects/phpMyID http://siege.org/projects/phpMyID. Simple setup, works nicely and like I said, it supports pavatars.
- Gmo 17y agoThanks
- andrewcooke 17y agoit's like reading a post from a mirror world. in my world i make it easy to find my email address by googling my name - it's a link on the top result. why? because then people can send email. as a result they do things like offer me jobs and pay me. why would i want to stop people knowing who i am or what my email address is? (fwiw i currently use gmail for spam filtering, but have also had success with spamassassin)
- walesmd 17y agoSo, the argument is because the hash is displayed it can be reversed by subsequently hashing every known combination of characters with every known mail provider? I'll give a shiny nickel to the first person that can reverse this hash: 9b60573dba6b13029b245bbdf7d01323 Moral: Not everyone uses some variation on their name nor do they use the most common email providers.