104

Users who register for their account via Facebook get their Facebook profile photo as their default avatar. However, the avatar is not copied to SE servers or Imgur, and thus the original URL is kept. This URL compromises the privacy of the user as it contains their Facebook user ID which everyone can easily extract and then view the profile.

The image is also not visible at all to those who have Facebook blocked for their own privacy (by extensions such as Ghostery or browser features like Firefox's Tracking Protection), or due to network policy (e.g. some work and school networks block Facebook).

With the new avatar system, it would be much better if the Facebook photo was stored like a manually uploaded avatar to avoid this problem.

8

1 Answer 1

6

I agree fully and believe Stack Exchange should work towards mitigating this privacy risk, although I would take it further and point out that off-site embedded images of all kinds are an issue. It would not be difficult to require all images use the Stack Exchange Imgur account. This would not only preserve privacy, but would have the additional advantage of reducing link-rot in both posts and avatars.

This is not just a theoretical issue. I have used embedded images to discover someone's geographic location on this site (it's not against the rules; I've asked), and it's easily conceivable that this could be used to do actual harm. Remember, there are people from all over the world who visit Stack Overflow, sometimes from work, and sometimes in countries which strongly prohibit the accessed material.

3
  • You might be interested in this related request: meta.stackexchange.com/q/55665/377214 May 26, 2020 at 10:07
  • Geographic location? To what degree of accuracy? May 27, 2020 at 11:14
  • @P.Mort. - forgot Clay Shirky_q, It usually depends on the accuracy of GeoIP (potentially augmented by additional sleuthing), but for authority figures who can subpoena your ISP, it is accurate enough to get your home address.
    – SarGe
    Jan 3, 2021 at 14:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .