Since some time, new users and users who change their profile image, get a salt added to their email address when they want to use an automatically generated Gravatar identicon. Great!
With the annual Data Privacy Day coming up on January 28th†: why not send out some system wide alert (or some Inbox message, or a blog post if other notifications are truly deemed too intrusive) that day, to tell folks they can easily get a more secure identicon?
Happy Data Privacy Day! Using a generated identicon on these sites? Get a more secure avatar!
Some linked explanatory post could be something like:
When using Gravatar for your profile picture, your email address is encoded (MD5 hash) in the image URL. When using very common providers such as Gmail, this might be subject to brute force attacks, and hence a privacy concern.
If you're using an automatically generated Gravatar identicon, then you can easily get a more secure version on Stack Exchange:
- Log in and go to your profile
- Click "change picture" when hovering your profile picture
- Select the new identicon
- Optionally copy the same image to all your Stack Exchange profiles: click "edit" to edit your profile, and then click "Save And Copy Profile To All Stack Exchange Accounts"
This will change the identicon. If you want to keep using your old icon, you can still make it safer: download the old icon, and then upload it to the Stack Exchange image hosting, using the same "change picture" dialog. This will use a different URL, which does not include your encoded email address.
When you're not using an automatically generated identicon, but instead uploaded an image to Gravatar, then your email address will still be encoded the old way. Stack Exchange cannot change that. If this bothers you, then you can also upload the same picture to Stack Exchange and no longer use Gravatar URLs on these sites.
More help on How do I change my profile picture, or avatar?
† and still no definitive answer to "Someone contacted me by email but my email is not public"... ;-)