10

The URI generated for my Gravatar link contains an unique identifier. As this is not the MD5 of my email, what is it?

If the MD5 uses somebody else's email, how can I retrieve that? If something else instead of MD5 is used to create it, what?

My (all-lowercase) email (which has a different MD5, according to my MD5 generator and this site) is visible in my profile settings. It has not been changed, and is provided via social media.

The suggestion given in this question is not helpful - following the suggestion does not change the matter.

The explanation given on that site may or may not be relevant, but anyway the token does not change with changed IP.

BTW: I am not primarily interested in using gravatar pictures. I am doing security investigation about those recognizeable strings and need to know from what they are generated and what information they can spill.

Addendum: As people seem to not know how Gravatar is supposed to function, an explanation:

Any website that knows the email addresses of their users can retrieve avatars stored at Gravatar. This is achieved by creating an MD5 hash from the respective email address and hot-linking an image with this MD5 hash from Gravatar. In case the user has an avatar stored at Gravatar with the same email address, Gravatar knows the MD5 and will deliver that image.

In any case, no matter if something is stored at Gravatar or not, the MD5 will be created by the local site and will be publicly included in the webpage. This imposes a security risk: by this MD5 a user can be re-identified on different websites, even if the email itself is not published on these websites.

In my case, Stack Overflow creates this MD5 for my account, but it is not the one belonging to my email address as stored in the profile. Therefore, I probably cannot control it by changing my email address, and I do not know what kind of personal data may be contained in it.

3
  • 1
    Is there a reason you are not asking gravatar, and are instead asking those who use it? In short: Unless someone at SE is on the gravatar team, you're not going to get any answers.. and even if they were, I'd assume that's proprietary knowledge.
    – Daedalus
    Commented Apr 1, 2018 at 4:17
  • 4
    Absolutely yes. The question is totally unrelated to gravatar, and I have no dealings whatsoever with gravatar. The question is only about an (assumed) MD5 string which is created and published from this site here, supposedly from an EMail address stored on this site here. Addendum: if it is indeed "propriary knowledge" how this site here handles classified personal data, then i think that is an interesting case.
    – PMc
    Commented Apr 1, 2018 at 4:22
  • They did something about it. Commented Apr 1, 2018 at 14:40

1 Answer 1

8

That second question pretty accurately describes the situation. We don't use the bare IP, but a salted version of it.

So... if you have an email address in your profile and we detect that you actually have a Gravatar set up for that email, then we'll use your email by default.

If the above isn't true, we use a salted version of your IP address. I don't believe this is updated on IP changes, only when you explicitly change your profile picture by editing your profile (and maybe not even then - it might just always use the first IP we saw).

You can know exactly which one is being used by editing your profile and clicking on the change picture button. If you have a Gravatar available, there will be a Gravatar option and it will be checked if you are using that option. The Identicon option is always available in the list, and always uses your salted IP address when checked.

3
  • I am unaware that it is possible to detect/distinguish if gravatar delivers an actually stored image or an ersatz artwork (aka identicon). If this is indeed possible, then Your description explains the matter and removes the concerns.
    – PMc
    Commented Apr 1, 2018 at 5:07
  • @PMc I don't know exactly how we actually detect it, but a simple thing like seeing if your Gravatar with default Identicon is the same image as Gravatar with forced Identicon would be a way of detecting if the user has an actual image.
    – animuson StaffMod
    Commented Apr 1, 2018 at 5:10
  • What You describe seems indeed the most professional and safe way to do it. I checked and verified this all and it works as You describe, only it does NOT work with the email adress configured in the profile, but with an (invisible) one delivered from the social-media login - this might be related to that -rather diffuse- topic here.
    – PMc
    Commented Apr 1, 2018 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .