Someone contacted me by email but my email is not public

Question

Last week I got an email to my email address saying "I saw on Stack Overflow that you were interested in.." and the content of the question I asked. The email suggested I'll star a bug \ feature request on chromium website. The request is totally legit and I don't mind it at all, my main concern is that my email is somewhat exposed on Stack Overflow.

I emailed this guy back and asked him where did he get my email address from, he replied with "I made a long list of folks to email to tell about the bug report, so I don't remember specifics of any of them."

I'm sure that I'll get a lot of responses here saying that stack keeps our emails private but, the facts are:

1. I never published \ used this email address on Stack Overflow beside my login.
2. My user name is short and unique for Stack Overflow. (I don't use it on other sites what eliminates the chance that a Google search will show my email address for a specific user.. I don't think someone will do a search for a 3 letters username and expect to find anything)
3. Googling my user name and my email address will return zero results.

Is it possible the Stack Overflow team using users emails for their own benefit?

I don't know how relevant that is but on this guy about.me site it says that he is an ex-Googler.

Update:

A grace period on the bounty has started so I'm adding here what I've got so far. Even if my SO login email is buried somewhere in the stack pages (which I still doubt) finding it, as we all figured out, isn't an easy task. I don't think that someone on his right mind (besides us :) ) would waste more than a minute to find someones email for something that minor such as staring a bug.

Possible solutions:

1. There's a dead simple MD5 extractor that can revert any MD5 to its original string.
2. The person that emailed me gained some kind of access to the SO user list

I've forwarded the email, as requested, to one of the SO team, maybe that will help us solve this mystery.

Update 2:

One of the users in the comments (@Arjan):

2 hours ago I left a comment on one of his answers,(he his referring to the person who emailed me. He found his SO username) to get his attention for this very question, and now the whole answer is gone.Okay, it was not a very good answer. But assuming he deleted himself, he knows about this very question now, but he did not respond -- yet

The comment above was written on the 24 of Nov. The user in question got his first 100 rep Association Bonus on meta on the 24 of Nov. He definitely saw the comment, deleted his answer, read this question and chose to ignore it.

Update 3:

You should all read hwlau answer which makes perfect sense and describes how vulnerable MD5 is and how people can use that to their advantage.

Answer 1

The user that contacted you performed a search, found your question, then visited your user page. He had no other contact with any of your other content. That's all the information our logs show.

As others have said, it's possible the user has access to an MD5-to-email lookup. To mitigate the ease of obtaining gravatar hashes, we've already removed them from data dumps and data.stackexchange.com, and we're working on a solution for the remaining places the hashes are exposed (i.e. on the sites themselves and their apis).

Answer 2

Here's one way they could have done it.

I was able to link you to a GitHub account based on a Dropbox link you posted (with a quick Google to make the connection). From there, I cloned your repository and your email address was visible in the raw Git commit data.

I also found a MozillaZine account, but I couldn't find any Chromium bug tracker connections.

To respect your privacy, I won't be any more specific (unless you ask otherwise).

Someone really wanted to talk to you (or maybe they found an easier way).

Answer 3

The situation mentioned by @D.W. is very true. A simple calculation below suggests that all emails with less than 11 characters must be cracked, and I will give a motivation to do so.

The data dump here already contains all the MD5 hashed emails and the corresponding userid. Hence, it would be possible to do a brute force matching and there are someone do has hundreds GPU hanging around. Suppose each top GPU could have 1GHash/s, and there are 100 GPU, and run for 3 days. It gives total H = (10^9 * 100 * 3 * 86400) ~ 2.6*10^16 hash. Also, assuming the character set are only letters (no capital), numbers and some symbols which accounts for at most 40 letter, so log(H)/log(40) = 10.25

It means that all emails with 10 or less characters from major email providers must be cracked already with brute force. Provided you have the equipments, it is easy to do and it requires very low technical skills compared with the "advance skills" like dictionary attacked (which should be harder to parallelize in GPU, I guess). Definitely, more can be cracked if they spend more time, but the basic one is really just hours of setup.

About the motivation, someone might find it fun to do it, but it does cost their time and money to run the equipments. So if they can sell dozens of the userid<->emails list, it would a good motivation. The list might have various use. In particular, with the price and restriction on career.stackoverflow, such a simple list would be very handle for the companies bypassing the system and directly contacting with the candidates. There are various email lists out in the wild and the person using it might not even know where it is from. Also, most of users being contact would not notice that it is leak from here as their emails are likely being reused. Anyway, my point is such list is easy to create and there is enough motivation to do so.

Even though the stack keep saying that emails are private, but they already release the email list, in an easily decoding MD5 which they don't even salt it.

---

Edit: It could have been harder and make this attempt infeasible if the data dump contains salted md5 hash, which requires attempting one email at a time so my above estimation is for one email only. But with the unsalted hash, the GPU only need blind hashing all combinations and send the results back to CPU which then compares all user emails at once. So it is faster by the factor of #users and make the extraction feasible. The limitation would be memory bandwidth which I did not include in my estimation, but the results only slow down few times depending on hardwares.

Answer 4

The mail address in your profile is private, only mods and SE employees can see it and they are not allowed to share it with third parties. Sharing PII like mail addresses is covered by the moderator agreement, and each access to that information is logged as well. SE doesn't sell mail addresses or something like that as far as I know.

The usual way someone gets your email address if it isn't published in your profile is by correlating your account with another one that has the mail associated. If your user profile contains enough information to identify you, the mail address could then be taken from your Twitter or Facebook account or any other source that can be somehow connected to your account.

In your specific case I can't actually see how this would have worked, though. I don't see enough personal information in your profile.

Answer 5

There are some technical aspects of the Stack Exchange platform that could, at least in principle, allow someone to deduce your email address. I somehow doubt that it's what happened to you, but I'll document it here for posterity, since I haven't seen it written down anywhere else.

In particular, the MD5 hash of your email address is made publicly visible in data dumps and via Data Explorer (e.g., try this query). Moreover, for many people it will be possible to recover your email address, given its MD5 hash. For many people, their email address has relatively low entropy: there are a handful of common options for the domain name, and one can enumerate many common possibilities for the username (one can also use your profile and your StackExchange username to help seed candidates for the username). This provides a large list of candidate email addresses for you. Then, one can use offline dictionary search to test each one against the known MD5 hash, to see if any of those have the same MD5 as your known MD5 hash. Due to the improvements in use of GPUs for password cracking, there are existing tools for this sort of MD5 reversing that are surprisingly efficient. Based upon past analyses, I would expect that many (but not all) users could have their email address recovered.

I haven't seen any place that publicly discloses this risk. I learned about it on a post I made to MSO a while ago that has since been auto-deleted.

That said, while this is technically possible, I don't know whether it's likely that anyone will bother to go to these lengths just to learn your email address. They'd have to download a MD5 cracker, configure it to help it generate plausible email addresses, tweak it by hand, and leave it running for hours. That doesn't sound super-plausible to me.

Bottom line: my expectation would be that there's some other explanation -- that this is not the cause of the email you got. However, I suppose it's possible, in theory.

Answer 6

Due to a technical weakness in the gravatar system, if you use an auto-generated Gravatar, in many situations it would be technically possible to derive your email address from the Gravatar you use. Whether anyone will go to the lengths necessary to do so is less clear, but it is technically possible.

Here's how. The URL to your Gravatar contains a MD5 hash of your email address in the URL. There is no salt in the MD5 hash, so it is possible to do a dictionary attack: guess many possibilities at your email, and test each one to see whether it is correct. If your email address is guessable (and many people's email addresses are), then this would be one way that someone could learn your email address, if you use the default the Gravatar.

I once wrote a detailed technical explanation of this on Meta.StackOverflow, but it looks like the question was deleted (some folks took exception to my characterization of this as a privacy weakness or felt it was covered by prior discussion and downvoted the question, so it ended up with a total score of -2: +11 upvotes, -13 downvotes; as a result it eventually got auto-deleted by the Community user), so you won't be able to read it unless you have > 10K rep on MSO. You can find a less detailed explanation here, but that post is old, so it doesn't take into account the potential for GPU-based dictionary attacks, which potentially change the risk calculus, and it misses some relevant links and analysis.

If I recall correctly, I believe this only applies to people who use the default auto-generated Gravatar. If you upload your own avatar image, it doesn't apply to you. It looks like you currently have a custom avatar image, so assuming this is not something new for you, I suspect this doesn't apply to you and so probably wasn't the way they got your email address. But I'm just trying to document this for posterity, in case anyone else runs across this situation.