7

Some Stack Exchange sites allow to ask an anonymous question by specifying a one-time user name and an email which is "required, but never shown". However the Gravatar attached to the email is shown anyway. Anonymous users do not want their picture to appear - someone can find their identity via google image search or someone that knows them.

Example: open incognito window and ask a guest question in travelexchange:

enter image description here

  • To make the user visually distinctive and harder to confuse with other users involved in the back-and-forth? Why would SE not display a unique gravatar for each unique user? If you're saying it is possible to reverse engineer the image and determine the email address, that's a different question altogether. – Dan Bron Apr 24 '15 at 17:23
  • 1
    anonymous users probably do not want their picture to appear. someone can track them through google images or simply by knowing them. – Yaron Naveh Apr 24 '15 at 17:40
8

You have a misconception here - you seem to assume we are using direct gravatar hashes that leak email addresses.

We don't. For unregistered users (and others, who don't already have a gravatar), we salt the address prior to hashing to avoid exactly that privacy leak.

See the answer on Unexpectedly changing identicon for details.

  • 1
    if someone does not want their real user name or email to appear in a question there are valid reasons to believe they do not want their picture there as well. The leak does not have to be through hash - it can be through google image search or someone that knows you. – Yaron Naveh Apr 24 '15 at 17:38
  • 1
    @Yaron If SE salts the email before Gravatar-ing it, then that Gravatar would only appear on SE, and nowhere else. It creates a unique identity for that person, but that identity ceases to exist outside SE. Best of both worlds. – Dan Bron Apr 24 '15 at 17:42
  • 1
    @Dan, the image that appears for an anonymous question by user a@a.com is the same image that will appear in any site that user logs in with that email (even outside SE) and is presumably a real photo (while the user asked to stay anonymous) – Yaron Naveh Apr 24 '15 at 17:44
  • 1
    @Yaron - that is incorrect. We use a salt on the email address. Thinks of it like this - we add "some unique difficult to guess string" to the email address, then we hash. How does that allow anyone who doesn't have that salt to get the same image and hash? – Oded Apr 24 '15 at 17:46
  • @Oded - the image appears on the question. someone can search for similar images in google search, or maybe if they happen to know you they will know you asked the question – Yaron Naveh Apr 24 '15 at 17:48
  • 2
    I really don't follow your reasoning here, @Yaron. Even if they find similar images via google search, they will not correspond to the email address because of the salt. They might correspond to some other, unrelated email address. I also find your "they happen to know you" a straw man - highly unlikely and still requires a lot more than "just knowing you". – Oded Apr 24 '15 at 17:52
  • let's say I ask some private health question on healthexchange. I want 100% guarentee that no one will identify I asked that question. but suddenly my picture appears right there! this is a real picture, so maybe someone that knows me can track me. this picture is used in many other sites (people tend to reuse pictures) and probably in one of those sited I made some less secret post so my email (or any other personal info for that matter) will be revealed. the hash/salt thing is secondary here, my question is not on that. it's on the right for privacy (or communicating up front the lack of it) – Yaron Naveh Apr 24 '15 at 17:57
  • 1
    @Yaron - If you are posting using an email address you have not used on the Stack Exchange network, how will your picture "suddenly appear right there"? We use identicons for unregistered users. Please explain how the salted email => hash that shows an identicon would disclose anything? – Oded Apr 24 '15 at 18:00
  • 1
    Can you direct me to the description for anonymous questions that you are talking about, @Yaron? Not sure what you mean exactly. – Oded Apr 24 '15 at 18:05
  • 1
    Yaron, if I use email address a@b.com, that will produce a Gravatar which may appear elsewhere. BUT (BIG BUT) StackExchange doesn't use that Gravatar. It uses a Gravatar based on a-random@b.com, which is not used elsewhere and for which the image cannot be traced. – Andrew Leach Apr 24 '15 at 18:12
  • 1
    @Yaron - you have yet to explain how showing an identicon (hash of salt+email) violates that guarantee. If someone posts a question (or answer) as guest, they will have an unregistered user on the site, using the identicon (as they have not uploaded a profile picture). This identicon will never show up on any other site outside of the network. – Oded Apr 24 '15 at 18:14
  • 4
    @Yaron - you have a complete misunderstanding of how it works. If gravatar doesn't find the hash (which, due to salting is highly unlikely they will), they generate a random image. There is no uploaded image happening here at all. And if there is it would be unrelated to the email address because of salting. – Oded Apr 24 '15 at 18:20
  • 2
    thanks @oded and all for your patience! I still don't agree with you but it's not that critical. for a fact, earlier today I published a question in travelexchange as a guest using my real email but my real avatar appears there even though I expected it to be completely anonymous. I'm sure you are right from the technical perspective with the hash and all, just from the human engineering side of things I got an unexpected (and possibly dangerous) behavior. – Yaron Naveh Apr 24 '15 at 18:27
  • 4
    @Yaron - that took a while to get to. I can see what you have experienced (and I wish we had gotten to that point a lot earlier). I can tell you that this is not how it is supposed to work and we are looking into how it happened. – Oded Apr 24 '15 at 18:33
  • 1
    "we salt the address" — you do? I just posted an anonymous question, and the gravatar URL is exactly the same. – Thanatos Jul 30 '15 at 3:21
4

If you're using the same email address for posting questions on different sites, you should assume that it will be possible to associate them. We do not support opt-in "anonymous" posts in the way that (for instance) Slashdot allows you to post as "Anonymous Coward" while still using your normal account.

In fact, we do not actually support users operating multiple, separate accounts period. We don't prevent it, but if that's what you want to do then then the accounts have to actually be separate: different credentials, different email addresses, etc.

When you're posting as a "guest" (that is, not registering first), you're under no obligation to enter your real name or real email address... But if you do, you should assume that your post will be associated with you in some way. In fact, if you have existing accounts with the same email address the system may merge your new "unregistered" account into it and automatically link together your activity across sites.

...So, if you're using the same email address all over the network for posts you don't want associated, gravatar is the least of your worries.

Incidentally, the original idea behind Identicons (the pattern generated by Gravatar) was to enable forum users to reliably distinguish each other. Gravatar merely extends that concept to allow user-specified images, with the explicit intent of allowing your activity across multiple sites and services to be recognized. In other words, the "problem" you're describing is the whole point! If you don't like it, then upload your own image.

  • 1
    thanks for the clarification. when I fill the guest email it has a message "required, but never shown". that made me believe the whole question will be completely anonymous. it is fair to disallow anonymous questions, I just think the description here is misleading. – Yaron Naveh Apr 24 '15 at 18:38
  • Do you have any suggestions for how we might improve that wording, @YaronNaveh? Since that's only shown to users who aren't logged in, it's designed to provide an alternative for users who don't want to fully sign up...I'm not sure how to address your concern without writing a whole paragraph in that space, which is a whole different problem :) – Laura Apr 24 '15 at 18:40
  • 1
    maybe if you already have a registered user for that email redirect them for the login page. currently the "guest post" also acts as "quick login" which is not the original goal. – Yaron Naveh Apr 24 '15 at 18:42
  • That's an interesting idea; I think it deserves some consideration. – Shog9 Apr 24 '15 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .