What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I'm not sure how sensitive this piece of information is considered (don't throw stones), but I was wondering how SO calculates the email hash. We want to check if certain people for which we have the email addresses are also on SO. BTW, this is for academic research.

As far as we have seen, md5(email_address) does not match any entry in the SO data dump. So probably it's not exactly md5(email_address), but something else. Can you disclose how this works or is it private?

share|improve this question
3  
No one should be using md5 for hashing anything for any sort of security reason, so I'm not surprised it's not md5 –  Ben Brocka Jun 8 '12 at 13:41
    
Still, @Ben, it's done. –  Arjan Jun 8 '12 at 14:01
2  
@BenBrocka It is md5... –  Yannis Jun 8 '12 at 14:02
    
Oh, so it's Gravatar's fault... –  Ben Brocka Jun 8 '12 at 14:06

1 Answer 1

up vote 6 down vote accepted

Quickly running Select * from Users where Id=##UserID## in the Data Explorer, entering my userid, and cross-checking with my email, I can confirm that it's an md5 of the entire address (according to @Arjan, it converts to lowercase first).

Note that the main SE database does not hash emails (they're visible on a user's own profile and to mods)--they're just hashed in the dump for privacy. Why they're included in the dump is beyond me (maybe for cases like these?).

The hash is used to auto-generate your gravatar:

http://www.gravatar.com/avatar/<hash>?s=32&d=identicon&r=PG

Users who have not actually provided an email address will still have an "email hash", because one is neccessary to generate distinct avatars. In these cases it is generated from a salted hash of their latest IP address.

share|improve this answer
6  
If you want to display a user's avatar alongside their post you need their MD5 email hash because that's what Gravatar uses. It's not only exposed in the dump; I can just look at the src of your avatar to get it. –  Jeremy Banks Jun 8 '12 at 13:57
    
@JeremyBanks: Oh, right, I'd forgotten about that. I'll edit, one sec –  Manishearth Jun 8 '12 at 14:05
4  
And if according to Gravatar specs, it uses the lowercase email address. –  Arjan Jun 8 '12 at 14:07
    
@Arjan: Let me test that out. –  Manishearth Jun 8 '12 at 14:08
    
@Arjan: Hmm, can't find any user on chem.SE with a generated gravatar and a capital email id. I'll take your word for it :) –  Manishearth Jun 8 '12 at 14:15
    
@Arjan Try changing your email address in your profile. Stack Exchange converts it to lowercase when saving. –  Jeremy Banks Jun 8 '12 at 14:17
    
Thanks all! I tried it on myself and indeed md5(lower(myself)) is what I find in the data. The strange thing now is why we don't get any matches between our data and SO, but that's a different story. –  Bogdan Vasilescu Jun 8 '12 at 14:44
    
@Bodgan, maybe sane users don't use their regular email address on Stack Exchange, or in your database, and for example Gmail offers unlimited aliases. (Heck, I don't even use my full name anymore...) –  Arjan Jun 8 '12 at 15:16
    
md5(lower(email)) matches SO. I have 25k or so examples that confirm that. –  CodesInChaos Jun 8 '12 at 15:51
    
@code where did you get 25k SO email addys? O_o –  Manishearth Jun 8 '12 at 15:57
    
@TimManishEarth guessing and checking against the md5 hash. meta.stackexchange.com/a/84734/152255 –  CodesInChaos Jun 8 '12 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .