129

The user avatars that are displayed on every post are not all hosted on SE's imgur account, but on sources outside the control of Stack Exchange. The most prominent ones are Gravatar, Facebook and Google.

The consequences of this decision to allow off-site avatar hosting are that every time I open a page SE is broadcasting which page on SE sites I'm browsing.

In the simplest case, the information transferred is my IP address, my browser user agent and the site I'm looking at. While this is not data that identifies me directly, it is likely within the power of a company like Facebook or Google to associate it with other tracked data and identify some users this way.

I just tried the worse case and logged into Gravatar. In this case, when logged in, a cookie that uniquely identifies my Gravatar account was sent along with every Gravatar image on the page. So Gravatar can create an almost complete browsing history for a logged in user given how prevalent Gravatars are on SE sites.

Google doesn't send a cookie in this case, I don't know about Facebook as I don't have an account there.

As far as I understand, those sites are also not bound by the SE privacy policy, as SE probably doesn't have a contract with Facebook and Google on how they can use this data. So I don't know what they can do with this data and where the limits are.

I'm not a laywer, so I can't judge the legal aspect. But an interesting comparison are e.g. court cases in Germany where the Facebook "Like button" was declared illegal in some circumstances because it submits information to Facebook without getting user consent before.

The off-site avatars also have other drawbacks. Gravatar has been less than stable in the past at times, and as it's entirely outside the control of SE they can't fix any issues like this. The Facebook avatars are blocked by the default setting of the Firefox tracking protection, so anyone using Firefox with this enabled will see a slightly broken SE site. Firefox is also enabling tracking protection by default now, so this will affect a lot more people soon.

SE should stop hosting avatars on other sites, to prevent their users being tracked by those sites.

As an example, this is how MSE looks like when I enable the more strict version of the Firefox tracking protection. Every broken avatar there is an image that submits information to somewhere outside SE's control.

Improve this question
23
  • 2
    As for Facebook (MSO): Embedding Facebook avatars enables tracking of Stack Overflow users.
    – Shadow Wizard Love Zelda
    Jun 2, 2019 at 11:23
  • 2
    @ShadowTheCurlyBracedWizard We don't know whether there are any copyright issues with this, because SE has never commented or answered on any of the posts related to this issue. There might be some, but I can't judge that.
    – Mad Scientist
    Jun 2, 2019 at 11:27
  • 22
    Welcome to the magic world of Internet, where browsing a site automagically means that you have agreed to be served malwertising by some cheap ads provider that the site decided to use without any form of security assessment beforehand (and they won't even be liable of any damage you had thanks to them!). Anyway, more seriously... I doubt you will get any solution to this issue anytime soon... so I can only advise that you use some browser plugin to just block off http requests to domains you don't approve. UMatrix works great for that.
    – SPArcheon
    Jun 3, 2019 at 9:08
  • 2
    @SPArchaeologist the Firefox tracking protection blocks some or all of this depending on the setting. That solves the tracking for me alone, but also breaks the site to some extent, which is annoying. I shouldn't have to look at that many broken images just to avoid the tracking.
    – Mad Scientist
    Jun 3, 2019 at 11:16
  • 3
    @MadScientist I know and I for one agree with you, but history kinda suggest this won't be changed anytime soon. See for example all the related post quoted here. Again - you have my support, but I fear that for now you will have to live with the broken images
    – SPArcheon
    Jun 3, 2019 at 15:24
  • 1
    Meh, i'll take this kind of privacy risk for convenience any day.
    – Kevin B
    Jun 3, 2019 at 20:08
  • 8
    @Won't The like buttons isn't illegal, just the default implementation of it. The only thing you have to change is to only load Facebook resources after a user clicked on it, and not before it. Anyone actually clicking on it did consent to being tracked by Facebook, but people aren't really aware that Facebook can track every site with that button they visit in the default implementation.
    – Mad Scientist
    Jun 3, 2019 at 21:00
  • 1
    A bit like told by you in 2014: Disallow new embedded images from hosts other than the SE imgur account
    – yagmoth555
    Jun 5, 2019 at 3:30
  • 3
    @ShadowTheCurlyBracedWizard It's not copying the image, it would be caching the image. There should not be a copyright issue there, or a big chunk of Internet infrastructure would be in violation. If you did cache the avatars, how often would you check for an updated avatar? When would you check (when someone requested it, or periodically just to refresh the cache)?
    – 1201ProgramAlarm
    Jun 5, 2019 at 3:48
  • 1
    I think that it is something we should ask one of the community managers directly to get the attention of the company towards the issue.
    – user79161
    Jun 25, 2019 at 14:47
  • 1
    @dim It just shows that someone feels strongly enough about the issue to use their rep. It's like a hunger strike; all it does is show that you're serious. Not that rep and food are equally important...
    – forest distrusts StackExchange
    Jul 18, 2019 at 1:44
  • 4
    @KevinB I'm blocking them, which makes the SE sites look rather ugly in parts with all the broken avatar images. It's not something you can do without side effects.
    – Mad Scientist
    Jul 18, 2019 at 19:48
  • 7
    Hellooooo Stack Exchange how ya doin' - feel like answering?? Please don't take your product (us) for granted!
    – Lightness Races in Orbit
    Jul 23, 2019 at 23:34
  • 4
    @LightnessRacesinOrbit Official response by Tim on the corresponding MSO thread: meta.stackoverflow.com/a/387618
    – Magisch
    Jul 24, 2019 at 16:13
  • 7
    @Magisch The response must have been deleted. It's not there anymore.
    – forest distrusts StackExchange
    Jul 27, 2019 at 1:52

2 Answers 2

Reset to default
31
+150

I agree fully and believe Stack Exchange should work towards mitigating this privacy risk, although I would take it further and point out that off-site embedded images of all kinds are an issue. It would not be difficult to require all images use the Stack Exchange Imgur account. This would not only preserve privacy, but would have the additional advantage of reducing link-rot in both posts and avatars.

This is not just a theoretical issue. I have used embedded images to discover someone's geographic location on this site (it's not against the rules; I've asked), and it's easily conceivable that this could be used to do actual harm. Remember, there are people from all over the world who visit Stack Overflow, sometimes from work, and sometimes in countries which strongly prohibit the accessed material.

Improve this answer
1
17
+250

I'd love to see Stack do away with foreign sourced avatars and images (and anything else embedded) alltogether. They already have a domain for that, namely i.stack.imgur.com. The most consistent and user friendly way to do this would be to enforce hosting on that for any and all images. Anything else can be a link. This carries the additional benefit of pre-emptively preventing link rot or something like the imageshack disaster.

In addition to that it would disallow facebook from tracking us.

Improve this answer
3
  • 1
    How does this answer differ from this older one?
    – Monica Cellio
    Jul 24, 2019 at 20:53
  • @MonicaCellio mine extends to any kind of off site embedded content. Basically, if it's not a link, it should be sandboxed or disallowed. I guess it wasn't really clear from writing it, but I've edited.
    – Magisch
    Jul 24, 2019 at 21:13
  • 1
    Oh, like embedded YouTube videos on the sites that have them -- I see. Thanks for the edit; that wasn't clear to me before.
    – Monica Cellio
    Jul 24, 2019 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .