18

Area 51 uses a different system for avatars than the rest of the network. While on every other site Gravatar URIs are salted, on Area 51 they aren't because it hasn't been updated (Area 51 uses a 2011 fork of the SE engine and the change was made in 2013). This could allow determining the email address associated with any user who has an Area 51 account. Avatars on Area 51 should also be salted to prevent this.

Area 51 avatars should be salted the same way as the rest of the network to prevent this information leakage.

See also this deferred request for the whole avatar system to be updated (I don't want a whole revamp, just this one bug fixed).

4
  • 5
    In a similar security issue, I find no way to actually delete an account on Area 51 like other sites.
    – Casey
    Mar 20, 2021 at 15:44
  • @Casey You can have your Area 51 account removed by contacting SE. Mar 21, 2021 at 3:14
  • @SonictheCuriouserHedgehog But why can't it be deleted directly by me like other SE sites?
    – Casey
    Mar 21, 2021 at 15:19
  • 2
    @Casey As the question says, Area 51 uses a very old fork of the SE engine, from 2011 to be exact. The ability to delete one's own account wasn't implemented in the main SE engine until 2017. Mar 21, 2021 at 18:42

1 Answer 1

6

This has been added to our backlog to be addressed by our bug duty rotation. That being said, we may be getting close to a point where we need to pay off some Area 51-related tech debt, so it might get addressed as a part of a bigger project rather than bug duty.

Either way, we'll keep y'all updated about progress as it happens.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .