7

A recent Slashdot article speaks about how somebody was able to discover the email addresses of 10% of SO users through the username and Gravatar system.

http://tech.slashdot.org/story/09/12/15/2352218/Gravatars-Can-Leak-Users-Email-Addresses

"Gravatar offers a global avatar service, using an MD5 hash of the user's email as avatar ID. This piece of information in some cases is enough to retrieve the original email address. Testing a simple attack on stackoverflow.com, I was able to determine the email addresses of more than 10% of the site's users.

Improve this question
6

3 Answers 3

Reset to default
12

The easy answer: if you're concerned about this, make sure your Stack Overflow username is different than your email address.

In other words, if your Stack Overflow username is:

eggsmclaren

and your email address is

[email protected]

It doesn't take rocket surgery to use the MD5 gravatar hash to figure that out, IMO. Heck, you could probably brute force a lot of those by sheer guessing!

The article itself says:

This attack is effective if you can deduce a limited set of emails which could belong to the users, but useless otherwise. If a user named paul registers as [email protected] then this approach doesn't work.

Improve this answer
2
  • The only thing I would add is a "successful attack" using this mechanism is not a security risk to email accounts besides making known to malicious entity X that the email account exists (assuming the user registered their SO account with it) So it takes away the ability of the email account owner to hide by not responding to (e.g.) spam emails. Otherwise it's fairly innocuous in nature, I think. Most email providers have decent spam filtering in place.
    – John K
    Dec 18, 2009 at 7:23
  • This attack doesn't only concern people where the SO username is identical with the email username, but everybody who has a low entropy email. In particular you can find many email addresses with a form like [email protected] or [email protected].
    – CodesInChaos
    Jan 28, 2012 at 17:02
9

Have you seen the Wave thread? That even has a list of all the IDs neatly displayed (the Google Wave ID is the same as your gmail account). The thing is, if you really want to, it's not that hard to guess more than 10% of the email accounts simply by looking through the About me section, their personal blogs, their Twitter account, or just guessing based on their username here.

The use of Gravatar only helps, but it's not exactly crucial. Also, considering I already get a lot of emails from Nigerians trying to sell me authentic gold plated, V|@G®a branded, replica R0le>< watches, I would presume others already have my email address.

Improve this answer
2
0

SO might have a lot of users, but a 10% yield is awful. Yes, it can be done. Will it happen in the wild? Highly unlikely. Where's the gain? Not financial, surely, SO is for programmers, and they tend to realise nigerian princes don't e-mail developers with the promise of cash.

If you're really worried, grab another e-mail and use that instead. But really, this sort of attack isn't going to be relevant for a while. (For one thing, there are WAY easier ways to harvest e-mail addresses than renting an entire computing farm)

Improve this answer
1
  • 4
    I'm driving this Ferrari we tried to give away on our site. Apparently no one wanted it, even though we advertised that they won it with a huge blinking ad.
    – Gnome
    Jan 8, 2010 at 7:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .