What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 129 Stack Exchange communities.

The Gravatar URL uses an md5 hash of the lower-case email address.

So I'd expect my Gravatar to use MD5("")="d41d8cd98f00b204e9800998ecf8427e"

However, my Gravatar actually uses "dfc87203d5c57e2ad21acc178eead605". Where does this value come from?

share|improve this question

1 Answer 1

up vote 14 down vote accepted

Since February 2011, Stack Exchange uses a salted hash of your IP address as a fallback to generate your gravatar if no email has been specified.


It used to be an MD5 hash of your IP address. For example, if your IP was 127.0.0.1, then its MD5 hash is f528764d624db129b32c21fbca0cb8d6 and your gravatar would be:

enter image description here

These unsalted hashes are still available in older database dumps.

share|improve this answer
3  
Cheers, "dfc..." is indeed the md5 hash of my IP address in dot-decimal form. Which kind of sucks. –  arx Feb 11 '12 at 20:45
1  
@arx If it used an empty string then everyone without an email address would have the same Gravatar, whereas by using your IP address (or the one you used when you registered perhaps) then it's at least limiting the clashes to your network - If you supply or change your email address, it will update your Gravatar to use that. –  Zhaph - Ben Duguid Feb 11 '12 at 21:28
8  
@Zhaph-BenDuguid I fully understand that, but I don't see any problem with users getting the same gravatar. A modern GPU can calculate about 4 billion MD5 hashes of 15 character strings (i.e. basically the entire IP4 address space) in one second. The current system is effectively publishing my IP address. I'm not entirely happy with that. I guess I'll set an email. –  arx Feb 11 '12 at 22:25
2  
@arx in such case you might have a case to post feature request asking to not use your IP address or at least add warning about that so new users will be aware of the "risk". The system can use your unique Stack Exchange ID - for example yours is 110524 –  Shadow Wizard Feb 12 '12 at 9:45
1  
@arx, you can use an e-mail address at example.com if you wish people to realize it's fake. –  msh210 Feb 13 '12 at 18:44
    
@msh210: Cheers, that's exactly what I did. –  arx Feb 13 '12 at 19:53
1  
Looks like about 10% of gravatar hashes on SE are IPv4 based. (About 10000 total as of Jan 2011) –  CodesInChaos Mar 8 '12 at 20:50
    
@arx The system is not publishing your IP address. If you can get your IP address back out of a one-way hash algorithm, please publish your methodology widely--you will be an overnight sensation in cryptographic circles! –  CodeGnome Jun 8 '12 at 14:24
5  
@CodeGnome his point was that the IPv4 address space is finite and small enough for a modern computer to crunch. You can just md5 them all and create a database of hashes and all you need to do is a string match with your gravatar hash. If it's an IP, you'll get a hit, if not, it's an email based hash. The salt was added after this answer was posted (feature request by the same OP) and Jeremy banks edited that in. –  Lorem Ipsum Jun 8 '12 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .