Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

Possible Duplicate:
Is using gravatar a security risk?

A recent Slashdot article speaks about how somebody was able to discover the email addresses of 10% of SO users through the username and Gravatar system.

"Gravatar offers a global avatar service, using an MD5 hash of the user's email as avatar ID. This piece of information in some cases is enough to retrieve the original email address. Testing a simple attack on, I was able to determine the email addresses of more than 10% of the site's users.

share|improve this question
Closing to keep discussion in one place – Marc Gravell Dec 16 '09 at 7:19
reopening since use of the username is the salient point here. Different discussion, IMO. – Jeff Atwood Dec 16 '09 at 8:54
Can we merge the two questions and answers? – Ether Dec 16 '09 at 15:59
no, because one is to address the article, which is about USERNAMES being a weakness, and the other is kind of b.s. hand wavy tinfoil hat stuff. – Jeff Atwood Dec 16 '09 at 23:03
up vote 11 down vote accepted

The easy answer: if you're concerned about this, make sure your Stack Overflow username is different than your email address.

In other words, if your Stack Overflow username is:


and your email address is

It doesn't take rocket surgery to use the MD5 gravatar hash to figure that out, IMO. Heck, you could probably brute force a lot of those by sheer guessing!

The article itself says:

This attack is effective if you can deduce a limited set of emails which could belong to the users, but useless otherwise. If a user named paul registers as john@some.domain then this approach doesn't work.

share|improve this answer
The only thing I would add is a "successful attack" using this mechanism is not a security risk to email accounts besides making known to malicious entity X that the email account exists (assuming the user registered their SO account with it) So it takes away the ability of the email account owner to hide by not responding to (e.g.) spam emails. Otherwise it's fairly innocuous in nature, I think. Most email providers have decent spam filtering in place. – John K Dec 18 '09 at 7:23
This attack doesn't only concern people where the SO username is identical with the email username, but everybody who has a low entropy email. In particular you can find many email addresses with a form like or – CodesInChaos Jan 28 '12 at 17:02

Have you seen the Wave thread? That even has a list of all the IDs neatly displayed (the Google Wave ID is the same as your gmail account). The thing is, if you really want to, it's not that hard to guess more than 10% of the email accounts simply by looking through the About me section, their personal blogs, their Twitter account, or just guessing based on their username here.

The use of Gravatar only helps, but it's not exactly crucial. Also, considering I already get a lot of emails from Nigerians trying to sell me authentic gold plated, V|@G®a branded, replica R0le>< watches, I would presume others already have my email address.

share|improve this answer
relevant: – snicker Dec 16 '09 at 16:10
Google Wave lol – Jeff Atwood Jan 28 '12 at 18:11

SO might have a lot of users, but a 10% yield is awful. Yes, it can be done. Will it happen in the wild? Highly unlikely. Where's the gain? Not financial, surely, SO is for programmers, and they tend to realise nigerian princes don't e-mail developers with the promise of cash.

If you're really worried, grab another e-mail and use that instead. But really, this sort of attack isn't going to be relevant for a while. (For one thing, there are WAY easier ways to harvest e-mail addresses than renting an entire computing farm)

share|improve this answer
I'm driving this Ferrari we tried to give away on our site. Apparently no one wanted it, even though we advertised that they won it with a huge blinking ad. – Gnome Jan 8 '10 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .