10

The Gravatar URL uses an md5 hash of the lower-case email address.

So I'd expect my Gravatar to use MD5("")="d41d8cd98f00b204e9800998ecf8427e"

However, my Gravatar actually uses "dfc87203d5c57e2ad21acc178eead605". Where does this value come from?

Improve this question

1 Answer 1

Reset to default
14

Since February 2011, Stack Exchange uses a salted hash of your IP address as a fallback to generate your gravatar if no email has been specified.

It used to be an MD5 hash of your IP address. For example, if your IP was 127.0.0.1, then its MD5 hash is f528764d624db129b32c21fbca0cb8d6 and your gravatar would be:

enter image description here

These unsalted hashes are still available in older database dumps.

Improve this answer
9
  • 3
    Cheers, "dfc..." is indeed the md5 hash of my IP address in dot-decimal form. Which kind of sucks.
    – arx
    Feb 11, 2012 at 20:45
  • 1
    @arx If it used an empty string then everyone without an email address would have the same Gravatar, whereas by using your IP address (or the one you used when you registered perhaps) then it's at least limiting the clashes to your network - If you supply or change your email address, it will update your Gravatar to use that.
    – Zhaph - Ben Duguid
    Feb 11, 2012 at 21:28
  • 9
    @Zhaph-BenDuguid I fully understand that, but I don't see any problem with users getting the same gravatar. A modern GPU can calculate about 4 billion MD5 hashes of 15 character strings (i.e. basically the entire IP4 address space) in one second. The current system is effectively publishing my IP address. I'm not entirely happy with that. I guess I'll set an email.
    – arx
    Feb 11, 2012 at 22:25
  • 2
    @arx in such case you might have a case to post feature request asking to not use your IP address or at least add warning about that so new users will be aware of the "risk". The system can use your unique Stack Exchange ID - for example yours is 110524
    – Shadow The Spring Wizard
    Feb 12, 2012 at 9:45
  • 1
    @arx, you can use an e-mail address at example.com if you wish people to realize it's fake.
    – msh210
    Feb 13, 2012 at 18:44
  • @msh210: Cheers, that's exactly what I did.
    – arx
    Feb 13, 2012 at 19:53
  • 1
    Looks like about 10% of gravatar hashes on SE are IPv4 based. (About 10000 total as of Jan 2011)
    – CodesInChaos
    Mar 8, 2012 at 20:50
  • @arx The system is not publishing your IP address. If you can get your IP address back out of a one-way hash algorithm, please publish your methodology widely--you will be an overnight sensation in cryptographic circles!
    – CodeGnome
    Jun 8, 2012 at 14:24
  • 6
    @CodeGnome his point was that the IPv4 address space is finite and small enough for a modern computer to crunch. You can just md5 them all and create a database of hashes and all you need to do is a string match with your gravatar hash. If it's an IP, you'll get a hit, if not, it's an email based hash. The salt was added after this answer was posted (feature request by the same OP) and Jeremy banks edited that in.
    – Lorem Ipsum
    Jun 8, 2012 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .