As I discovered yesterday, if you don't configure an email address your Gravatar is based on your IP address. Specifically, SE calculates the MD5 hash of your IP address in dotted-decimal notation.
Reading some older posts on the internet (not specifically related to SE) it seems that the intention of this feature was to allows anonymous users to be identified without revealing their IP address.
This is a fail for a couple of reasons:
- Users on SE are not anonymous, so the rationale for this feature is absent.
- A modern GPU can calculate about 4 billion MD5 hashes of 15 character strings (i.e. basically the entire IP4 address space) in one second. The current system is effectively publishing the user's IP address.
Please change the system so that, in the absence of an email address, Gravatars are based on a hash of the user's id number. This is public information anyway, so nothing is being revealed.