I know that reversing the hash would be quite time consuming, but isn't there a privacy concern with including email hashes in the data dump. If I want to know if a person with a specific email address has a stackoverflow account, all I have to do is load the data into an SQL database and:

Select * from users where emailhash = md5('email@example.com');

and if I got any results then I would know that an account exists for email@example.com.


The email hashes are already available on every page of Stack Overflow, so the fact that they're included in the dump is sort of irrelevant.

If you are concerned, you should:

  1. Not use an email that is obviously related to your username; e.g. if your username is "waffles" and your email is "waffles@gmail.com" that's pretty easy to guess. Compare with "iluvzwaffles512@gmail.com"

  2. Hash your email address; instead of "waffles@gmail.com" use "waffles+stackoverflow@gmail.com"

  • 3
    And 2) is not only a good idea for the datadump, but on any site that (now, or in the future) uses Gravatar or similar services, and hence exposes the same hash on the site itself. Too bad the given @gmail.com example does not work for each provider. Choose your provider and alias wisely (no, not "+stackoverflow"). (See sub-adressing aka plus-addressing at en.wikipedia.org/wiki/E-mail_address#Sub-addressing, or "aliases" according to Gmail at mail.google.com/support/bin/answer.py?answer=12096) – Arjan Mar 4 '10 at 7:26
  • Hmmm, I wanted to click "edit" to change the @gmail examples into @example.com examples as per RFC 2606 --though maybe the spammers harvesting bots go into the revision history as well-- but I have no edit powers on Meta... Luckily meta.stackoverflow.com/users/17174/waffles uses a different address on this site. ;-) – Arjan Mar 4 '10 at 7:33

if I got any results then I would know that an account exists for email@example.com.

And which account it belongs to.

However, this requires you to know the email address first. Once you know the address, what's the advantage to knowing that this person has an account here?

Just because you can glean information from the dump doesn't mean the information is a security risk.


"Security concern" implies that there's a risk. What's the risk of knowing whether or not there's an SO account for any given email?

Only thing I can think of is an employer getting a little too miffed about someone spending too much time on SO during company hours. If that's the case, there's better ways to track that down.

  • And that's assuming the employer has the email the employee signed up for SO with. I'd be surprised if those that were concerned about privacy (to the point where they think this particular situation is of concern) would use a work email for SO. – Pollyanna Mar 4 '10 at 4:10
  • This question is about "privacy" concerns. The dupe you found at meta.stackexchange.com/questions/21117/… is about security. – Arjan Mar 4 '10 at 7:37
  • Privacy is an issue of security. If you need something to be private, you need to secure it. – squillman Mar 4 '10 at 12:23

The best way to put this to rest is not by quarterback armchairing but by proving this is a problem.

Send Jeff a list of 60K emails, I'm sure he will consider changing gravatar or something.

  • Was "quarterback armchairing" meant to be a pun on "armchair quarterbacking"? – Andrew Grimm Jan 10 '13 at 7:57

If you are worried about your privacy you can salt your email: email+salt@example.com.
But honestly, if you're privacy-concerned you should have been protecting your email address, not your SO account...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .