Hacker News Reader

Comment by nzmsv | Hacker News Reader

An idea for a quick fix: use

  my.address+really_long_random_string@famousprovider.com

as your Gravatar e-mail. Will work if famousprovider==gmail at least.

View on HN

The big problem with that is that you'd have to use the same

  really_long_random_string

to register for every gravatar-enabled site you want to register for.

The only benefit I can see of this is that you could easily blacklist emails destined for that address.

Doesn't have to be a really long and random string. Just has to be something that can't be easily deduced from your name and/or username. This might not defeat rainbow tables, but I think there are probably easier ways to harvest email addresses than to generate rainbow tables and troll for gravatar URLs.

Does that actually work with Gravatar and the blogapp plugins that call it?

A ton of people validate addresses using Regular Expressions but don't have the fortitude to copy-paste the monster regex needed to do it correctly.

This will work fine with gravatar.

You just have to associate the + address with your account - you can even give it a different image so you could have a different identity on every site without needing multiple email addresses.

It would also have to be your email on every service you register with, since they use your email automatically to get a gravatar.

Why is that an issue? It defeats this attack if it is 'username+12345acbdefg@gmail.com', right? Unless we really think that people are going to get into rainbow tables just to extract some email addresses.

Reply on news.ycombinator.com