9

Hi all,

I am working on what I think will prove to be a very exciting project with the SO data dump data and would like to use user avatars but alas I need each user's email address, well their email address hashed with md5 to be exact.

I'm not actually requesting the email address be included, just the hash.

I know the knee jerk response is: "with that hash you can write code to reverse it into the actual email address" -- yes that is true, however I could just as easily do this by scraping each user's profile page and getting the hash that way.

Please and thank you SO team :)

|improve this question
  • 2
    Can you reverse it? I wasn't aware that MD5 was broken that heavily. – waiwai933 Jan 12 '10 at 3:37
  • waiwai933 - look up "rainbow tables" to see the full extent of the problem. – zombat Jan 12 '10 at 3:44
  • 1
    Actually, that brings up an interesting point. Are gravatar ids just hashes of the emails? Do they even salt them? – zombat Jan 12 '10 at 3:46
  • 3
    I upvote this, cause it would make it easier to prove that gravatars are a security risk. – waffles Jan 12 '10 at 3:58
  • So not actually reversing the encryption. I thought for a moment there, that the algorithm had been broken. – waiwai933 Jan 12 '10 at 4:04
  • 1
    There is a long discussion on SO about this. While you can't reverse them and rainbow tables won't help that much (after all, there are infinite input combinations for each hash), you can use them to guess e-Mails. Take the username or firstname and lastname and some well known mail provider addresses like gmail.com, hotmail.com etc. and then just try out many combinations. That works often. Not always of course, but it can easily get hundreds of valid addresses. – Michael Stum♦ Jan 12 '10 at 4:15
  • 5
    This guy has had some success gleaning email addresses from Stack Overflow based on the Gravatar hash: developer.it/post/… (summary: 8597 addresses, or ~10% of those scraped). While I normally might be against including the email hash, I think the cat's sufficiently out of the bag that it might do more good than further harm. – Kyle Cronin Jan 12 '10 at 5:04
  • 1
    @Michael Can you provide a link to that discussion? – An̲̳̳drew Jan 13 '10 at 8:31
4

Security issues aside, I think if the hashes are available publicly on our profile pages, they should be fair game in a data dump as well.

As mentioned, anyone determined enough to gain this set of data could do so without a data dump.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .