Users who register for their account via Facebook get their Facebook profile photo as their default avatar. However, the avatar is not copied to SE servers or Imgur, and thus the original URL is kept. This URL compromises the privacy of the user as it contains their Facebook user ID which everyone can easily extract and then view the profile.

The image is also not visible at all to those who have Facebook blocked for their own privacy (by extensions such as Ghostery or browser features like Firefox's Tracking Protection), or due to network policy (e.g. some work and school networks block Facebook).

With the new avatar system, it would be much better if the Facebook photo was stored like a manually uploaded avatar to avoid this problem.


I agree fully and believe Stack Exchange should work towards mitigating this privacy risk, although I would take it further and point out that off-site embedded images of all kinds are an issue. It would not be difficult to require all images use the Stack Exchange Imgur account. This would not only preserve privacy, but would have the additional advantage of reducing link-rot in both posts and avatars.

This is not just a theoretical issue. I have used embedded images to discover someone's geographic location on this site (it's not against the rules; I've asked), and it's easily conceivable that this could be used to do actual harm. Remember, there are people from all over the world who visit Stack Overflow, sometimes from work, and sometimes in countries which strongly prohibit the accessed material.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .