As I discovered yesterday, if you don't configure an email address your Gravatar is based on your IP address. Specifically, SE calculates the MD5 hash of your IP address in dotted-decimal notation.

Reading some older posts on the internet (not specifically related to SE) it seems that the intention of this feature was to allows anonymous users to be identified without revealing their IP address.

This is a fail for a couple of reasons:

  1. Users on SE are not anonymous, so the rationale for this feature is absent.
  2. A modern GPU can calculate about 4 billion MD5 hashes of 15 character strings (i.e. basically the entire IP4 address space) in one second. The current system is effectively publishing the user's IP address.

Please change the system so that, in the absence of an email address, Gravatars are based on a hash of the user's id number. This is public information anyway, so nothing is being revealed.

  • "Users on SE are not anonymous" Please elaborate. – BoltClock's a Unicorn Feb 12 '12 at 15:49
  • 5
    @BoltClock'saUnicorn - Who said that??? Who's there??? – Lix Feb 12 '12 at 15:56
  • 1
    @Lix: Who are you and why are you talking to me like that? – BoltClock's a Unicorn Feb 12 '12 at 15:59
  • 2
    @BoltClock'saUnicorn - How do you know my name?? What is this?? Where are the cameras?? ;) – Lix Feb 12 '12 at 16:00
  • One disadvantage to this idea is that anonymous re-regs (so to speak) become slightly less obvious to normal users. – Charles Feb 12 '12 at 16:10
  • 3
    Publishing the IP of a user without explicitly telling him you do, is very bad style. – CodesInChaos Feb 12 '12 at 16:26
  • @Charles: Anyone who wants to "anonymously" re-register can set a bogus email address to change their gravatar. This isn't a good excuse for leaking the IP addresses of average users. At the very least this leakage should be made absolutely clear. – arx Feb 12 '12 at 17:07
  • @BoltClock'saUnicorn: You're BoltClock's a Unicorn; I'm arx. These are probably not our "real" names (a vague concept anyway). So what? To clarify: by anonymous user I mean unregistered, or at least with no user ID publicly displayed. – arx Feb 12 '12 at 17:22
  • @arx - my IP address also isn't my real name... – Flexo Feb 12 '12 at 18:35
  • 2
    and if I really wanted to find somebody's IP address I'd just use an image on an external site and watch the logs, far, far easier than looking up 4 billion images! – Flexo Feb 12 '12 at 18:37
  • 1
    @awoodland: With an external site, how would you know who the request was coming from? And you don't have to look up four billion images. You grab the md5 hash from the gravatar image url and reverse that. – arx Feb 12 '12 at 18:41
  • "A modern GPU can calculate about 4 billion MD5 hashes of 15 character strings (i.e. basically the entire IP4 address space) in one second." Er, not sure I agree with that. My GPU was only able to perform 29.8M md5 hashes / sec. – uɐɯsO uɐɥʇɐN Feb 12 '12 at 22:01
  • 1
    Haha, I started writing a request that IPs be salted before I had to leave this morning. I get back, and there's a complete request waiting for me. It's like magic! – Jeremy Feb 13 '12 at 0:50

I just added a salt to the IP address hashing, we have no user id to go by for anonymous users and still would like to keep stable gravatars.

This should keep stuff working just as it always did, with added security.

  • Now all of the anonymous users should have new Gravatars, right? – uɐɯsO uɐɥʇɐN Feb 13 '12 at 1:08
  • once deployed, yes – waffles Feb 13 '12 at 1:09
  • Thanks for that. I didn't realise there were truly anonymous users. What can you do on the site that doesn't require a login? And how long is the salt? – arx Feb 13 '12 at 14:16
  • I thought to post without logging in, you must enter an email? At least the field says "required". I assumed those email less users logged in, but from an OpenID provider that doesn't supply an email. – CodesInChaos Mar 9 '12 at 19:42
  • Using a salted IP address still allows people in the same house to discover each other's StackExchange accounts, because they will have the same hash. There is still a privacy issue. You really should use the user ID if there is one. – Boann Jul 26 '14 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .