Area 51 uses a different system for avatars than the rest of the network. While on every other site Gravatar URIs are salted, on Area 51 they aren't because it hasn't been updated (Area 51 uses a really old fork of the SE engine). This could allows determining the email address associated with any user who has an Area 51 account. Avatars on Area 51 should be salted to prevent this.

Area 51 avatars should be salted the same way as the rested of the network to prevent this information leakage.

See also this deferred request for the whole avatar system to be updated (I don't want a whole revamp, just this one bug fixed).

  • 5
    In a similar security issue, I find no way to actually delete an account on Area 51 like other sites. – Casey Mar 20 at 15:44
  • @Casey You can have your Area 51 account removed by contacting SE. – Sonic the Anonymous Hedgehog Mar 21 at 3:14
  • @SonictheCuriouserHedgehog But why can't it be deleted directly by me like other SE sites? – Casey Mar 21 at 15:19
  • @Casey As the question says, Area 51 uses a very old fork of the SE engine, from 2011 to be exact. The ability to delete one's own account wasn't implemented in the main SE engine until 2017. – Sonic the Anonymous Hedgehog Mar 21 at 18:42

You must log in to answer this question.

Browse other questions tagged .