Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 155 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I log into https://www.masterbranch.com and it has this option to link my stackoverflow user, but it ask me to type my email ( probably just to avoid me pointint to Jon's )

I type some random email for I don't want them to have my email but they notice it wasn't the one I use in SO.

How could they?

This is what it shows

My guess, is they fetch the gravatar from stackoverflow and the gravatar from the email I type, but I don't really know if that makes sense.

Is there a security hole in StackOverflow?

share|improve this question
2  
Now, that is my email! How did you get to know it? – kiamlaluno Jun 29 '11 at 22:25
    
from your OpenID maybe? – Marcelo Jun 29 '11 at 22:26
    
I tried too, but it didn't fill my email address. I used ClaimID, though, to log in. – kiamlaluno Jun 29 '11 at 22:29
    
I don't know, I used openid.stackexchange ... I have a different email in openid.stackexchange and in stackoverflow ( or my gravatar for that matter ) – OscarRyz Jun 29 '11 at 22:36
    
Gravatar uses a hash of the email, so if they know the hashing algorithm, they could just run it themselves and compare the two results. Not 100% accurate but close enough. – mmyers Jun 29 '11 at 22:37
    
@mmyers: That's my idea. They don't even need to know the algorithm, they can get the image and compare it directly, but, I wonder if this is what they did. BTW, I'm glad you rolledback your user name... :) :) :) :) No no don't kill me ......:I – OscarRyz Jun 29 '11 at 22:41

As Michael J. Myers said:

Gravatar uses a hash of the email, so if they know the hashing algorithm, they could just run it themselves and compare the two results. Not 100% accurate but close enough.

This is like storing a hash of your password, it doesn't mean they know your password, just that the hashes match.. etc.

share|improve this answer
3  
Pretty obvious, in retrospect. A bit creepy if you don't know what's going on. – Robert Harvey Jun 29 '11 at 23:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .