3 ms·
An idea for a quick fix: use my.address+really_long_random_string@famousprovider.com as your Gravatar e-mail. Will work if famousprovider==gmail at least.
by nzmsv 17y ago
An idea for a quick fix: use
my.address+really_long_random_string@famousprovider.com
as your Gravatar e-mail. Will work if famousprovider==gmail at least.
- blasdel 17y agoDoes that actually work with Gravatar and the blogapp plugins that call it? A ton of people validate addresses using Regular Expressions but don't have the fortitude to copy-paste the monster regex needed to do it correctly.
- westi 17y agoThis will work fine with gravatar. You just have to associate the + address with your account - you can even give it a different image so you could have a different identity on every site without needing multiple email addresses.
- ChadB 17y agoThe big problem with that is that you'd have to use the same really_long_random_string to register for every gravatar-enabled site you want to register for. The only benefit I can see of this is that you could easily blacklist emails destined for that address.
- pyre 17y agoDoesn't have to be a really long and random string. Just has to be something that can't be easily deduced from your name and/or username. This might not defeat rainbow tables, but I think there are probably easier ways to harvest email addresses than to generate rainbow tables and troll for gravatar URLs.
- ars 17y agoIt would also have to be your email on every service you register with, since they use your email automatically to get a gravatar.
- pyre 17y agoWhy is that an issue? It defeats this attack if it is 'username+12345acbdefg@gmail.com', right? Unless we really think that people are going to get into rainbow tables just to extract some email addresses.