Is Gravatar a privacy risk?

In December 2009, somebody tested getting email addresses from some of the Stack Overflow users, by assuming the display name might be related to an email account at some of the major providers. According to Gravatars: why publishing your email's hash is not a good idea that assumption is true for about 10% of the SO users:

Running my program on a list of 80871 users I was able to extract 8597 email addresses, associated to their users. This means that for a bit more than 10% of the users, the username and the gravatar URL are enough to deduce the email address they used to register to the website.

In 2013, folks reversed the MD5 hashes of email addresses in a data dump to recover the email addresses of users of Startups.SE, after it closed, as a way to reboot the community. Also, in 2013 someone else used a similar technique to recover 45% of email addresses at a large forum, by exploiting this weakness in Gravatar (the ability to reverse MD5 hashes of email addresses). This is more evidence that email addresses can be recovered despite the use of the hash.

(Apart from this, I also dislike the web bug nature of Gravatar and the like.)

IMO sites need to use gravatar sensibly.

If you say you don't publish your users' email addresses, that should mean you don't publish an MD5sum of their email addresses either. Hashing sensitive data without a salt is a schoolboy error: web developers should know better. Publishing the hash of some private data is a breach of privacy if the data is subject to a dictionary attack, which email addresses are.

Just replace address@domain with address+salt@domain.

SO in effect allows you to do this manually, by setting the email address for your account. It doesn't use the address for anything other than gravatar unless you ask it to, so it doesn't have to really be your email address.

I'm pretty sure this is an accident, though, not a security feature, since SO also uses your IP address in the absence of an email address. IP addresses are even more subject to dictionary attack than email addresses.

Of course for the salt to be effective in preventing gravatar tracking you across sites, gravatar has to not know the email address behind it (since if it did know, it could merge the records of address+*@domain). This means that (a) you must live with a random icon, and therefore (b) the user should be able to specify whether they want the salt added or not. If your email provider doesn't support +salt, and you want the site to be able to send you email without publishing the hash of your email address, then you're generally out of luck: you can have one or the other.

In fact I'd say that ideally sites should default to just generating a random "md5sum" for each user, and only use the email address to generate a gravatar URL with permission. For users with no interest in uploading an image to gravatar, there's no earthly reason why any site should use a gravatar URL based on supposedly-private data. Unless you count ignorance of basic security principles as a "reason" ;-)

As someone who provides a similar service (however on a scale that's a tiny bit smaller), I have to say that I myself am sometimes concerned what kind of information I could pull from the access logs if I wanted to.

On the other hand, whenever I comment on some blog, join a forum or whatever, it's my own choice to provide my personal email address. If I'm concerned about that, I can either a) not join at all, b) not provide an email address (if the site allows that, as SO does), or c) create an extra email address for this purpose.

So my view is: It's no bigger or smaller problem than any other privacy concerns resulting from data collection, be it PayPal knowing where you shop, myOpenId knowing where you log in, or Google knowing... well, everything.

That's not to say it's something that can be ignored, but I don't think Gravatar is a special case.

Gravataring an email address (MD5 hashing) is effectively making a single ID that identifies you publicly. Even if you never signed up with Gravatar, they're still tracking your ID that comes in - and the site using Gravatar is providing that ID to all users. This ID can be found on other sites, so if someone does a full transitive search across all public Internet forums, they could see what the same ID has posted. Where privacy breaks down is that if all of these sites know your real email address, and has publicly given everyone your Gravatar ID, then the Chinese government (for example) could harass not just a single entity, but ANY one of those websites that published your Gravatar ID.

What makes more sense to me is if Gravatar simply "GAVE OUT" an identifier (to you) if you sign up. And when you want to use your Gravatar, you simply give that same ID to sites that use Gravatar.

Sites that use Gravatar without your consent are the ones to blame. Gravatar's user base grows because of this principle (it's their business model - people that want a picture associated with their latest post).

I wish people would try to understand this concept first. Another poster here is generally correct in that if someone REALLY wanted to find out your real identity, they probably could, but Grav IDs make it even easier. You'll see when the equivalent of rainbow tables comes along for Grav IDs (like a site that lets you enter a gravid and it will tell you all URLs that use that GravID.)

I just thought of another way to secure gravatars- they could have used PKI rather than hashing. With PKI with some time based or per-instance/site salt, the ID would not be normalizable to an outsider. In fact, shame on Gravatar for not thinking of this. They're going to claim it has something to do with access to encryption APIs in the languages they are supporting, but I'm pre-emptively calling bullshit right now.

One problem with Gravatar isn't solved by blocking the server.

The website you use publishes the hash of your email address. At a minimum, this makes it possible to find other websites where you used the same email address.

Looking at the Jan 2011 Stack Exchange data dump:

• 105k unique Gravatar hashes
• 10k are IPv4 based, the IP address can be trivially found
• At least 27k of these are so simple they can be guessed. This does not require a relation between nick and address, but just that the email address is built using a common pattern, such as [email protected].
• Stack Exchange does not validate email addresses, so some of them are invalid. Since fake addresses are harder to guess (gdsfgsdf.sdfadf.com etc.), I assume that if we use valid addresses as a basis, the percentage of guessable addresses is even larger.

All of this applies even to users who have not registered an account with Gravatar.

Many websites (including Stack Overflow) promise to not publish your email address, but at the same time use Gravatar and thus leak information about about the email address they promised to keep secret. If websites insist on using Gravatar, they should at least tell the user that the email address gets published, instead of lying to their users.

Reproduced from https://webapps.stackexchange.com/a/30605/11058

Don't give your email and portrait to Gravatar. Regardless of whether you trust Gravatar Corp, it's easy for site owners to carelessly betray the identity of users posting under pseudonyms. A cautionary tale:

Hashim in Saudi Arabia secretly reads an American blog about homosexuality. One time, the blog discusses the Middle East, so Hashim comments describing his own experience. He is careful to give a false name 'bin Elton' to protect his identity. However the blog software, Wordpress, also demands an email address. The software promises 'your email address will not be published'. Hashim trusts the blog owner and thinks nothing of typing his email address. There's no risk, his email doesn't even contain his real name.

Two years later, Hashim signs up for Stack Overflow under his real name. He gives Gravatar his email and portrait.

Unbeknownst to Hashim , in 2011 Wordpress decided to install Gravatar on their platform, to make it 'more social'. Portraits are added to new comments, but also to millions of archived comments. (Wordpress didn't consider this a privacy issue, because email addresses remain secret). As a consequence, Hashim's portrait is now publicly displayed next to bin Elton's story.

Note that DoubleClick (now Google) has for a very long time collected such usage data.

If this is a concern, use your browser or your hosts file to block all accesses to Gravatar's servers. This will disable their ability to follow you.

Are these concerns real

Yes, for the reasons given in other answers on this page.

and if so, what defensive measures might be used?

Consider using the Privacy Badger browser plug-in from the Electronic Frontier Foundation (EFF), which helps defend against tracking by Gravatar and similar services.

Privacy Badger is free software.

Point 6 does not apply because the websites that show Gravatars do not send the raw e-mail address. They only send a MD5 hash. Here is the API documentation. But the hash of the e-mail of a gravatar.com account can be reversed if the user made the mistake of publishing his e-mail somewhere.

Point 4 is not the major issue.

Anyway, the major privacy issue is not just for registered gravatar.com users. It is for any web user that browse sites that use gravatars. This is because gravatar.com gets HTTP query from every page you visit that display gravatars. And gravatar.com does everything to force your browser to fetch the images everytime and bypass caching. Yes, gravatar.com is evil. You can check by yourself:

$ curl -I https://secure.gravatar.com/avatar/70d9b050bfe39350c234d710fadfcd39?s=130
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 10 Jun 2015 13:40:27 GMT
Content-Type: image/jpeg
Content-Length: 6226
Connection: keep-alive
Last-Modified: Fri, 18 Mar 2011 13:20:45 GMT
Link: <https://www.gravatar.com/avatar/70d9b050bfe39350c234d710fadfcd39?s=130>; rel="canonical"
Content-Disposition: inline; filename="70d9b050bfe39350c234d710fadfcd39.jpeg"
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
X-Varnish: 500790784 498172644
Via: 1.1 varnish
Expires: Wed, 10 Jun 2015 13:45:27 GMT
Cache-Control: max-age=300
Source-Age: 592

The caching is enabled only for 5 minutes (see Expires). Do you know many users that change their gravatar more than once a year (that would be the only use case for a short caching)? I don't. The short caching is just enabled to track you.

So your visits on any stackexchange.com, github.com, wordpress.com (among many others) are tracked by gravatar.com and they are able to track you accross those sites in the same way as Google Ads, Google Analytics, Twitter/Facebook like buttons.

This is why Ghostery blocks Gravatar.

Given the recent switch to Unicornify, I believe this question can be closed as status-completed.

Is Gravatar a privacy risk? WT*

I realize these posts are quite old, but I have been dismayed at the level of paranoia shown by some of the posters on this and similar threads.

Surely, in this day and age the cautious consciously obtains / maintains a few email accounts which matter little and are serviced even less... Just for all those mostly sign up and forget situations. So who cares if someone without a life and with huge amounts of computer power (and hacker software) eventually figures out an address from an hash.

If the name part of the free (probably) mail account(s) is mostly gobbledygook then that makes hash parsing / matching even harder. And if you use simple, real words, names or numbers for passwords to boot you have to accept you are really stupid.

But at the end of the day, a lot more worrisome for the paranoid (and so called "lawyers" with a bone to pick) are the plethora of form submission checks (AKA like excellent "aKismet") and general RBL access blockers / redirects used (quite rightly so) on so many web sites you won't even know about unless you are actually a spammer of various sorts.

All those rely on and receive our email addresses and IP addresses of which they wholly or in part rely on. Is an upfront service like Gravatar to be trusted less when those others could track FAR more than a few sites here and there displaying an avatar pic. I think not.

And while we're at it, get the Ghostery add-on for your browser and see just how many months it can take to get on top of (blocking) the huge amount of third-party tracking cookies we are barraged with. That's really scary too.

Discovery of a mere email address one consciously supplies has nothing on all those occurrences I mentioned, any of which if harvested can also be packaged for others at a profit. Any monetized site especially SHOULD declare it all in a readily accessed privacy declaration; does yours?