Gravatar leaks data on millions of users

itnews.com.au

9 points·garritfra··10 comments

Not surprised. I even made a privacy preserving proxy plug-in for Coral Talk, a comment system, that would hide the gravatars behind an UUID based parameter [1]. This was quite some time ago. I understand why Gravatar would choose to expose avatars using a hash of an email, but they could have used a more expensive hashing function.

[1] https://github.com/snorremd/talk-plugin-gravatar

Your username and hashed email were already public information if you used gravatar. It would be like complaining that hackernews is leaking my username right now.

It's all public info, but I think the big leak here is that if you attached multiple email addresses to your gravitar, it'd serve the same icon for each one, and with that data, it could connect all your multiple identities.

Also, if a site showed a gravitar along side your posts, and not an email address, folks now have an email address to connect to your posts.

I didn't realise that my username-email combination was public. I don't remember ever signing up to Gravatar. Why would I do that?

Your avatar URL is made up of a hash of your email.

Thanks! You have to make sure that the hex digits A-F are in lower case, so a-f.

It appears that I got my Gravatar account from a Wordpress account I made up ~1 month ago.

No, since I only know your username after you reply to this thread.

Yes, and I understand that my username is public information, so I'm not concerned if someone is able to create a dataset with my name in it.

But are you equally not concerned about your email address?

If I attached an email to my profile publically than it's expected that people would be able to look up my email.

Reply on news.ycombinator.com