Is using Gravatar a security risk?

Question

This has been discussed on Stack Overflow. It is unfortunate the accepted answer is so far from reality.

There are some facts:

• Gravatar's MD5 hash is an unsalted MD5 hash of an email address.
• A 3rd party could harvest every MD5 hash for every user's email on Stack Overflow.
• The 3rd party could store all the hashes in a lookup table
• Email addresses are usually of a very particular format
• The attacker could start with a brute force of @gmail.com followed by @yahoo.com, etc.
• The attacker has the advantage that he/she could attack a huge set of emails in one go. So instead of needing to brute force every email individually the attacker can brute force in bulk.
  • The algorithm is quite simple, calculate a "random" MD5, look it up in the lookup table.

Is Gravatar a big enough security risk to warrant caching images locally?

Examples:

1. Someone could harvest about 50k email addresses quite easily and shoot off a bogus promotion from Stack Overflow to all the users.
2. A spammer/stalker/generic evil guy can tie you identity to all the rest of the sites that use Gravatar.

Answer 1

I wonder how convenient is for a spammer to:

• Generate a possible email address
• Hash it
• See if it matches a known gravatar hash
• Send an email to it
• See if it bounces

instead of:

• Generate a possible email address
• Send an email to it
• See if it bounces

or (Workshop Alex's approach):

• Subscribe to technical mailing lists
• Grab the addresses from the emails
• Profit!

If you want addresses of programmers the last approach is much more economically viable. Supposing all you'd do is a brute force attack, you could even just grab the names from the profiles and try the second approach to get a similar list.

Privacy is a higher concern, but because you know you've signed to gravatar and you know at least it'll show up the same image everywhere you probably are conscious that you are giving some privacy up wherever you enter your email address.

Impersonation is the more worrying aspect of it and is not as easily solvable, in my opinion. But then again, it's not exclusive to gravatar, the additional component is that it will show your image. Anybody with or without gravatar can impersonate you at the same level if he knows your name and email address (that's why you use another auth mechanism.)

So, while I don't think this is a worrying thing that has to be fixed ASAP, it would be nice to have it fixed just in case with all this fuzz a spammer decides to give it a try :-)

Answer 2

To determine if something is a security risk, you'd also have to consider it's popularity and the amount of information a hacker would get considering the amount of time he'll have to invest to get this information.

In general, a hacker could get access to a list of email addresses. Are these valuable? Not really, unless the user doesn't use a spam filter. Then you could spam the Hell out of them. And perhaps you could collect a list of sites that a person is visiting. In my case, StackOverflow and the related sites. I don't use Gravatars anywhere else.

But collecting email addresses is much easier by just subscribing to mailing lists, Google and Yahoo Groups and by running a webspider over the Internet. Spammers are harvesting million of email addresses this way and can receive a lot more practical information than hacking into Gravatars.

I did a test once, several years back, checking how easy it is to harvest email addresses. I created a dozen Yahoo accounts and subscribed every account to about 30 different Yahoo groups. Yahoo still supported POP3 back then thus I could use a POP3 client to read my emails. And I would use this POP3 client to download all those emails to extract just the email addresses. These were stored in a database with a link to the account that discovered it plus additional information about the email like title and the CC list. It allowed me to discover a lot of information about who was active where and how often and I could even detect that some email accounts appeared to be linked to the same person. (And it allowed me to create a list of spammers which I could blacklist.)

The amount of information that I could collect this easily made me much more aware of my online privacy. I didn't get hundreds, or thousands of addresses... No, within a week I had about 25,000 different email addresses! It took me two months and some group switching to end up with ten times more addresses.

So I don't fear hackers gaining information about my email address through my Gravatar. They have a lot easier way to harvest email addresses!

---

The scheme I used to find email addresses by subscribing to mailing lists could even become more advanced. First you start with a few accounts and subscribe to a dozen mailing lists. As emails arrive, you can check these for email addresses of even more mailing lists. This, because some people are cross-posting their messages to multiple lists. Furthermore, most people seem to forget about the BCC option with email, which would hide all recipients. By detecting more mailing lists this way, you could subscribe to even more lists and create more accounts so no one notices that you're in 500+ different lists.
Not only would you be able to harvest lots of emails this way, you could even make a mapping of how different lists are related to each other and check the interests of each and every member, thus finding those members who might be more susceptible for certain kinds of fraud. For example, look at Stack Overflow, Super User and Server Fault. If these sites were just plain mailing lists and some posts would e.g. be crossposted to other lists then it's not too difficult to find possible system administrators who work for a company that uses Windows and VB webservices. If you could cross-check these members with a list called "hardCorePorn" and you find a few members that are part of SO/SU/SF and this HCP group then you know which of these members might be interested in opening an email offering free porn that actually contains some malware with the intent to infect their Windows servers. Even if only 1% of those people are fooled, if you find 1000 administrators then you can infect 10 sites with malware, and continue harvesting information from there.

Information is extremely valuable, especially if you can link them together. Even without the gravatar there's a big risk that someone still manages to get your email address from this site. Think of this: how many members here have a username that's very similar to their email address? Would Sam.Safron@yahoo.com be one? (Typing error in name made on purpose, just in case I guessed correctly!) Or perhaps WorkshopAlex@hotmail.com. (Nope!) With 90,000 users at Stack Overflow, if only 1% uses a username identical to their email address, plus @gmail, @yahoo.com or some other common mail provider, then just collecting user names from SO could already provide 900 email addresses! And of course, the first user already has a reasonable easy email address. Last name plus @provider. Fortunately, Jon Skeet doesn't use Gmail. :-) Yet he mentions his email address inside his profile so that's already one harvested address. Some members will also add an URL to their personal site, though. Jon does so too, and this additional information could have been used if he hadn't posted his email address too! Last name + @ + host of personal site = another harvested email address...

Don't worry about how insecure certain techniques are. In the end, the biggest security problem is the user himself, not the technique.

Answer 3

Yes, I've thought about this as well, but there's another aspect you haven't addressed: privacy. With any site that uses Gravatar you can identify a user on one site as being the same as the user on another.

Answer 4

On a time and resources trade-off it just would not be worth it for spammers to do this -

Current mechanisms for harvesting email addresses are pretty much 100% automated. Some spam list vendors charge more for fully validated lists, but it is known that there will always be a large proportion that are invalid at any time. Doesn't matter - it costs spammers nothing to send out emails to the list anyway.

Trying to grab email lists through matching gravatar hashes etc - not worth it.

Collation of data on which blogs you post to - okay this could be a worry for someone in a country where the political regime will punish you for visiting or posting on certain sites, sure, but for those of us not in those countries, everyone tracks this anyway. Are you up in arms about google analytics etc?

Impersonating you on a blog - so many ways to do it already, why bother making it difficult?

All in all, for an attacker it is a non-starter. There is no reward.

Answer 5

I am not convinced that your attack vector presents a beneficial trade-off of resources for targets to a potential attacker. How much time are they going to spend computing possible targets when they could be pursuing more lucrative means?

In addition:

• Stack Overflow users are more tech-savvy than most (as others have pointed out). The number of people who are going to even see your spam or phishing attempt is far lower than the general popluation.
• Stack Overflow uses OpenID, so there is no login screen to spoof, no password to steal. Even if someone falls for a Stack Overflow phishing e-mail, what information would the attacker gain?

You merely assert that this is an easy thing for someone to do, a "time bomb" to use your words, but you offer no profiling or statistical evidence to back up your claims. Are you really surprised to be seen as maybe a little paranoid? Get some hard data first, then we'll talk.