Hacker News Reader

Comment by lmm | Hacker News Reader

Any comments you make under your email address are attributable to that email address. Duh. The whole point of gravatar and disqus is to make it clear that your comments on a bunch of different sites are from the same person.

If you don't want a particular comment associated with your name or email, why would you ever fill in that name or email when commenting?

View on HN

From the same person, but not from that email address. Bad idea, but as per the article people expect these posts not to be linkable to their e-mail address. Why? Well, obviously, because that's the way Disqus works "usually".

If I go to comment at a wordpress site it says this:

"Email (required) (Address never made public)"

MD5 leaks of my email address into web pages is in fact making my address public.

Hey lmm, duh, when you make a comment under a different name but with the same email address that you think is anonymous at your local hiv testing site, you may not expect that your insurance company can track that down because wordpress has been leaking your md5 address all over the place.

>If I go to comment at a wordpress site it says this: "Email (required) (Address never made public)"

So wordpress - not disqus or gravatar (which I'm aware is owned by wordpress) - is lying to you. Let's put the blame in the right place.

No it doesn't. You need to know the email address up front in order to generate the hash.

But the point is that you can easily brute force that, especially if you have a list of people that you suspect may be making such comments and their email addresses.

Saying that your email is kept private by taking its MD5 sum is like expecting than an unsalted MD5 sum for a password hash in a publicly accessible password database will be secure for people with weak, brute-forcible passwords like "1234". You are providing a little bit of obfuscation, but no real security.

Reply on news.ycombinator.com