This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality.

There are some facts:

  • Gravatar's MD5 hash is an unsalted MD5 hash of an email address.
  • A 3rd party could harvest every MD5 hash for every user's email on Stack Overflow.
  • The 3rd party could store all the hashes in a lookup table
  • Email addresses are usually of a very particular format
  • The attacker could start with a brute force of @gmail.com followed by @yahoo.com, etc.
  • The attacker has the advantage that he/she could attack a huge set of emails in one go. So instead of needing to brute force every email individually the attacker can brute force in bulk.
    • The algorithm is quite simple, calculate a "random" MD5, look it up in the lookup table.

Is Gravatar a big enough security risk to warrant caching images locally?


  1. Someone could harvest about 50k email addresses quite easily and shoot off a bogus promotion from Stack Overflow to all the users.
  2. A spammer/stalker/generic evil guy can tie you identity to all the rest of the sites that use Gravatar.
  • I've changed my gravatar to be associated with my first name. Reading your question makes me feel a bit more secure :) – alex Sep 10 '09 at 6:50
  • 5
    I can see how this could possibly lead to more spam in your inbox. But how is that related to security? – innaM Sep 10 '09 at 6:54
  • 8
    Thought experiment, what if Jeff published email addresses in the data dump, would people be up in arms? – waffles Sep 10 '09 at 7:04
  • 2
    By the way, as a sort of side-issue, you could create an account at mailinator.com (it's not even creating an account really, just make up an id there) and use that here as your gravatar. Then it doesn't matter if someone emails you. Use an appropriately random string and life will be quite fine. – please delete me Sep 10 '09 at 7:55
  • I thought gravatars were hashes of your IP address, not email... – Eric Sep 10 '09 at 10:18
  • 3
    Eric, your IP address is computer bound, not user bound. It changes ever so often, for example when you log in at another computer, a lot of internet provider even change the customers IP daily. Highly unpractical to use the IP for user identification. – Sam Sep 10 '09 at 12:49
  • oh god, if eric gets one more point he's going to go on a killing spree the likes of which we haven't seen since ff7. – please delete me Sep 10 '09 at 14:23
  • 2
    @Eric - The IP address is used for posts by unregistered users who do not provide their email address when they post. Otherwise the email address hash is used. – Pollyanna Jan 24 '11 at 16:58
  • 2
  • 2
    For anyone who cannot access the question that the author of this question linked to: web.archive.org/web/20140804033606/https://stackoverflow.com/… – DaveTheMinion Jun 20 '17 at 17:57

I wonder how convenient is for a spammer to:

  • Generate a possible email address
  • Hash it
  • See if it matches a known gravatar hash
  • Send an email to it
  • See if it bounces

instead of:

  • Generate a possible email address
  • Send an email to it
  • See if it bounces

or (Workshop Alex's approach):

  • Subscribe to technical mailing lists
  • Grab the addresses from the emails
  • Profit!

If you want addresses of programmers the last approach is much more economically viable. Supposing all you'd do is a brute force attack, you could even just grab the names from the profiles and try the second approach to get a similar list.

Privacy is a higher concern, but because you know you've signed to gravatar and you know at least it'll show up the same image everywhere you probably are conscious that you are giving some privacy up wherever you enter your email address.

Impersonation is the more worrying aspect of it and is not as easily solvable, in my opinion. But then again, it's not exclusive to gravatar, the additional component is that it will show your image. Anybody with or without gravatar can impersonate you at the same level if he knows your name and email address (that's why you use another auth mechanism.)

So, while I don't think this is a worrying thing that has to be fixed ASAP, it would be nice to have it fixed just in case with all this fuzz a spammer decides to give it a try :-)

  • 1
    You are able to get about 50k known valid email addresses without posing a single thing anywhere, its significantly more convenient and it does not burn you early. – waffles Sep 10 '09 at 7:00
  • For a spammer I doubt it matters to send 1000k emails than 100k emails. The payoff rate is so much higher. – Vinko Vrsalovic ModStaff Sep 10 '09 at 7:04
  • 3
    Vinko, someone could target the stackoverflow audience with a promotional message from stackoverflow that is bogus, many people will not bother checking the email it came from – waffles Sep 10 '09 at 7:11
  • 2
    a) I doubt that's the case in SO and b) They could send the same targeted email to more addresses. Anyhow I suggest you reread the answer, I've edited it some :-) – Vinko Vrsalovic ModStaff Sep 10 '09 at 7:13
  • 2
    All I'm saying is, would you feel comfortable if Jeff published your email address in the data dump ? – waffles Sep 10 '09 at 7:18
  • And all I'm saying is, this isn't exactly like Jeff publishing my email address in the data dump. Although to answer your question, I wouldn't mind much. I filter most (99.99%) of the spam, and I'd never (knock on wood) fall for a phishing attack – Vinko Vrsalovic ModStaff Sep 10 '09 at 7:30
  • 7
    An offline modern laptop could check around 10,000,000,000 mail addresses an hour. I don't know how many e-mails could reasonably be sent (when online), but I'm guessing somewhat fewer. – Tom Hawtin - tackline Sep 11 '09 at 14:12
  • 3
    As for "Privacy is a higher concern, but because you know you've signed to gravatar [..]" -- not everyone actually subscribes at Gravatar, but still many sites send the hashed email address to that site. That raises other privacy concerns; see meta.stackexchange.com/questions/4553/non-gravatar-avatar/… – Arjan Dec 28 '09 at 10:57
  • @Tom: The problem is actually sending the email and handling bounces, not generating an address. @Arjan: Good point. – Vinko Vrsalovic ModStaff Dec 30 '09 at 20:09
  • 4
    # Subscribe to technical mailing lists # Grab the addresses from the emails # Hash it # See if it matches a known gravatar hash # Generate more personalized mail # Profit! – alexanderpas Oct 28 '10 at 0:45
  • Because this question has been mentioned on Discourse lately, I'm going to add that a modern email may can send that many emails, but most mail gateways won't let you ;-) And to answer Waffles: I wouldn't mind, my email address is all but evident for most everyone. – jcolebrand Feb 6 '13 at 17:36

To determine if something is a security risk, you'd also have to consider it's popularity and the amount of information a hacker would get considering the amount of time he'll have to invest to get this information.

In general, a hacker could get access to a list of email addresses. Are these valuable? Not really, unless the user doesn't use a spam filter. Then you could spam the Hell out of them. And perhaps you could collect a list of sites that a person is visiting. In my case, StackOverflow and the related sites. I don't use Gravatars anywhere else.

But collecting email addresses is much easier by just subscribing to mailing lists, Google and Yahoo Groups and by running a webspider over the Internet. Spammers are harvesting million of email addresses this way and can receive a lot more practical information than hacking into Gravatars.

I did a test once, several years back, checking how easy it is to harvest email addresses. I created a dozen Yahoo accounts and subscribed every account to about 30 different Yahoo groups. Yahoo still supported POP3 back then thus I could use a POP3 client to read my emails. And I would use this POP3 client to download all those emails to extract just the email addresses. These were stored in a database with a link to the account that discovered it plus additional information about the email like title and the CC list. It allowed me to discover a lot of information about who was active where and how often and I could even detect that some email accounts appeared to be linked to the same person. (And it allowed me to create a list of spammers which I could blacklist.)

The amount of information that I could collect this easily made me much more aware of my online privacy. I didn't get hundreds, or thousands of addresses... No, within a week I had about 25,000 different email addresses! It took me two months and some group switching to end up with ten times more addresses.

So I don't fear hackers gaining information about my email address through my Gravatar. They have a lot easier way to harvest email addresses!

The scheme I used to find email addresses by subscribing to mailing lists could even become more advanced. First you start with a few accounts and subscribe to a dozen mailing lists. As emails arrive, you can check these for email addresses of even more mailing lists. This, because some people are cross-posting their messages to multiple lists. Furthermore, most people seem to forget about the BCC option with email, which would hide all recipients. By detecting more mailing lists this way, you could subscribe to even more lists and create more accounts so no one notices that you're in 500+ different lists.
Not only would you be able to harvest lots of emails this way, you could even make a mapping of how different lists are related to each other and check the interests of each and every member, thus finding those members who might be more susceptible for certain kinds of fraud. For example, look at Stack Overflow, Super User and Server Fault. If these sites were just plain mailing lists and some posts would e.g. be crossposted to other lists then it's not too difficult to find possible system administrators who work for a company that uses Windows and VB webservices. If you could cross-check these members with a list called "hardCorePorn" and you find a few members that are part of SO/SU/SF and this HCP group then you know which of these members might be interested in opening an email offering free porn that actually contains some malware with the intent to infect their Windows servers. Even if only 1% of those people are fooled, if you find 1000 administrators then you can infect 10 sites with malware, and continue harvesting information from there.

Information is extremely valuable, especially if you can link them together. Even without the gravatar there's a big risk that someone still manages to get your email address from this site. Think of this: how many members here have a username that's very similar to their email address? Would Sam.Safron@yahoo.com be one? (Typing error in name made on purpose, just in case I guessed correctly!) Or perhaps WorkshopAlex@hotmail.com. (Nope!) With 90,000 users at Stack Overflow, if only 1% uses a username identical to their email address, plus @gmail, @yahoo.com or some other common mail provider, then just collecting user names from SO could already provide 900 email addresses! And of course, the first user already has a reasonable easy email address. Last name plus @provider. Fortunately, Jon Skeet doesn't use Gmail. :-) Yet he mentions his email address inside his profile so that's already one harvested address. Some members will also add an URL to their personal site, though. Jon does so too, and this additional information could have been used if he hadn't posted his email address too! Last name + @ + host of personal site = another harvested email address...

Don't worry about how insecure certain techniques are. In the end, the biggest security problem is the user himself, not the technique.

  • 5
    In other words, even though it could be possible, I'm not worried because it's not worth the effort. – Wim ten Brink Sep 10 '09 at 9:02
  • 2
    Yes, this is my point, you exemplified so much better. +2 if I could. – Vinko Vrsalovic ModStaff Sep 10 '09 at 9:12

Yes, I've thought about this as well, but there's another aspect you haven't addressed: privacy. With any site that uses Gravatar you can identify a user on one site as being the same as the user on another.

  • More importantly, you can trivially post as another user by using their email address (you don't need a password). So if you don't use a specifically private email address for you gravatar, it may be possible to find your regular email, and trivially impersonate you. – please delete me Sep 10 '09 at 6:54
  • 2
    But the user knows he is consciously doing so when he signs up for gravatar, no? – Vinko Vrsalovic ModStaff Sep 10 '09 at 6:55
  • 3
    That just makes me worry more :p This whole gravatar thing is a time bomb. Personally I care less if the evils get my email address, heck its on my blog and the spam is flowing. But, the whole concept of a big fat sweep of email addresses scares me somewhat. – waffles Sep 10 '09 at 6:55
  • @silky, are you saying that someone can post as me, if they only know my email. That would be a serious flaw in the system. – waffles Sep 10 '09 at 6:58
  • Sam: To be clear, NOT ON THIS SITE, but on another blog that implements it. Say on (IIRC) Phil Haacks site. If I know your email, I can trivially impersonate you there. – please delete me Sep 10 '09 at 6:59
  • Yeah the whole anonymous blog posting thing is a real pain, I can also just steal your gravatar image and make a post look like it came from you on 99% of blogs – waffles Sep 10 '09 at 7:01
  • @cletus, I changed the question to community wiki, feel free to add the privacy concern as well – waffles Sep 10 '09 at 7:07
  • But you could do that from before gravatar, no? The only change is that now it appears with an image – Vinko Vrsalovic ModStaff Sep 10 '09 at 7:11
  • 4
    Many blogs comment boxes promised your email will not be published but then went ahead in installing Gravatar, publishing readers' faces! webapps.stackexchange.com/a/30605/11058 – Colonel Panic Aug 31 '12 at 18:09

On a time and resources trade-off it just would not be worth it for spammers to do this -

Current mechanisms for harvesting email addresses are pretty much 100% automated. Some spam list vendors charge more for fully validated lists, but it is known that there will always be a large proportion that are invalid at any time. Doesn't matter - it costs spammers nothing to send out emails to the list anyway.

Trying to grab email lists through matching gravatar hashes etc - not worth it.

Collation of data on which blogs you post to - okay this could be a worry for someone in a country where the political regime will punish you for visiting or posting on certain sites, sure, but for those of us not in those countries, everyone tracks this anyway. Are you up in arms about google analytics etc?

Impersonating you on a blog - so many ways to do it already, why bother making it difficult?

All in all, for an attacker it is a non-starter. There is no reward.

  • 1
    A big part of mailing(/spamming) is finding out if the addresses in your harvested/purchased lists are real - there are a great deal of "spamtraps" and old accounts (which become traps) in these lists. The SO data dump provides a list of over a million MD5s of valid, current mailing addresses. – mikewaters Oct 26 '11 at 16:28
  • 2
    @threecheeseopera SO doesn't validate email addresses. You can anything that looks like an email address, at it will be accepted. – CodesInChaos Mar 9 '12 at 11:58

I am not convinced that your attack vector presents a beneficial trade-off of resources for targets to a potential attacker. How much time are they going to spend computing possible targets when they could be pursuing more lucrative means?

In addition:

  • Stack Overflow users are more tech-savvy than most (as others have pointed out). The number of people who are going to even see your spam or phishing attempt is far lower than the general popluation.
  • Stack Overflow uses OpenID, so there is no login screen to spoof, no password to steal. Even if someone falls for a Stack Overflow phishing e-mail, what information would the attacker gain?

You merely assert that this is an easy thing for someone to do, a "time bomb" to use your words, but you offer no profiling or statistical evidence to back up your claims. Are you really surprised to be seen as maybe a little paranoid? Get some hard data first, then we'll talk.

  • 2
    The could spoof the most common openID login screens (the google, myopenid, and yahoo ones) so openID doesn't make it invulnerable. Just because it can be defeated by "defense by obscurity" doesn't make it not a problem. – Macha Sep 10 '09 at 18:08
  • @Macha: Each additional screen they spoof reduces their likelihood of success. The fact that they have to spoof three logons and sitll may not have the right service significantly undermines their return on investment, which is my fundamental argument. Unless you can demonstrate that it's trivial to extract e-mail information from gravatars (as I asked the OP to do), I maintain that nobody will find this kind of attack to be worth their while. There are easier ways and more foolish userbases to make money from. – ベレアー アダム Sep 10 '09 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .