7

I'm not sure how sensitive this piece of information is considered (don't throw stones), but I was wondering how SO calculates the email hash. We want to check if certain people for which we have the email addresses are also on SO. BTW, this is for academic research.

As far as we have seen, md5(email_address) does not match any entry in the SO data dump. So probably it's not exactly md5(email_address), but something else. Can you disclose how this works or is it private?

Improve this question
4
  • 3
    No one should be using md5 for hashing anything for any sort of security reason, so I'm not surprised it's not md5
    – Zelda
    Commented Jun 8, 2012 at 13:41
  • Still, @Ben, it's done.
    – Arjan
    Commented Jun 8, 2012 at 14:01
  • 2
    @BenBrocka It is md5...
    – yannis
    Commented Jun 8, 2012 at 14:02
  • Oh, so it's Gravatar's fault...
    – Zelda
    Commented Jun 8, 2012 at 14:06

1 Answer 1

Reset to default
7

Quickly running Select * from Users where Id=##UserID## in the Data Explorer, entering my userid, and cross-checking with my email, I can confirm that it's an md5 of the entire address (according to @Arjan, it converts to lowercase first).

Note that the main SE database does not hash emails (they're visible on a user's own profile and to mods)--they're just hashed in the dump for privacy. Why they're included in the dump is beyond me (maybe for cases like these?).

The hash is used to auto-generate your gravatar:

http://www.gravatar.com/avatar/<hash>?s=32&d=identicon&r=PG

Users who have not actually provided an email address will still have an "email hash", because one is neccessary to generate distinct avatars. In these cases it is generated from a salted hash of their latest IP address.

Improve this answer
11
  • 6
    If you want to display a user's avatar alongside their post you need their MD5 email hash because that's what Gravatar uses. It's not only exposed in the dump; I can just look at the src of your avatar to get it.
    – Jeremy
    Commented Jun 8, 2012 at 13:57
  • @JeremyBanks: Oh, right, I'd forgotten about that. I'll edit, one sec
    – Manishearth
    Commented Jun 8, 2012 at 14:05
  • 4
    And if according to Gravatar specs, it uses the lowercase email address.
    – Arjan
    Commented Jun 8, 2012 at 14:07
  • @Arjan: Let me test that out.
    – Manishearth
    Commented Jun 8, 2012 at 14:08
  • @Arjan: Hmm, can't find any user on chem.SE with a generated gravatar and a capital email id. I'll take your word for it :)
    – Manishearth
    Commented Jun 8, 2012 at 14:15
  • @Arjan Try changing your email address in your profile. Stack Exchange converts it to lowercase when saving.
    – Jeremy
    Commented Jun 8, 2012 at 14:17
  • Thanks all! I tried it on myself and indeed md5(lower(myself)) is what I find in the data. The strange thing now is why we don't get any matches between our data and SO, but that's a different story.
    – Bogdan Vasilescu
    Commented Jun 8, 2012 at 14:44
  • @Bodgan, maybe sane users don't use their regular email address on Stack Exchange, or in your database, and for example Gmail offers unlimited aliases. (Heck, I don't even use my full name anymore...)
    – Arjan
    Commented Jun 8, 2012 at 15:16
  • md5(lower(email)) matches SO. I have 25k or so examples that confirm that.
    – CodesInChaos
    Commented Jun 8, 2012 at 15:51
  • @code where did you get 25k SO email addys? O_o
    – Manishearth
    Commented Jun 8, 2012 at 15:57
  • @TimManishEarth guessing and checking against the md5 hash. meta.stackexchange.com/a/84734/152255
    – CodesInChaos
    Commented Jun 8, 2012 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .