155

Alternative to Gravatar has been rolled out.

It would be nice to have the option to just upload an avatar rather than have to use some external service like gravatar.

While gravatar may be convenient and useful, it's also a serious privacy concern because the operators of gravatar have basically got a web bug that allows them to track users and identities across multiple sites. ISP proxy servers can do similar tracking, associating their own users with gravatars and logins on various sites just by analysing the proxy logs... as can corporate and other proxy servers.

Lots of people don't have a problem with that, but I do. So I refuse to use gravatar and similar services.

(I'm not terribly happy about OpenID for the same reason — but at least I can set up my own OpenID server if I want to... which is what I'm going to do when I can be bothered.)

Improve this question
15
  • Have you even read their privacy policy? automattic.com/privacy Automattic seems like a fairly decent company to me automattic.com They even run Wordpress.com!
    – Brad Gilbert
    Commented Aug 15, 2009 at 17:00
  • Plus they made all of the paid features free, after they took over blog.gravatar.com/2008/10/11/gravatar-one-year-later
    – Brad Gilbert
    Commented Aug 16, 2009 at 17:12
  • 33
    privacy policies are subject to change - what happens if gravatar gets bought out or goes bust or gets hacked? or if they change their policy or are just plain lying. and regardless of gravatar's policy and practices, there's still the issue of proxy logs. anyway, it's a matter of principle - it really doesn't matter how honest and trustworthy Automattic is, i don't ever want any third-party tracking my use of the web and associating my various accounts with each other.
    – cas
    Commented Sep 2, 2009 at 3:00
  • 9
    Indeed, the Gravatar feature is a nuisance. At the very least, I'dd expect it to work using the OpenID instead of the email address.
    – Dimitri C.
    Commented Sep 2, 2009 at 12:40
  • 38
    A nice story about getting bought: in the Netherlands there once was an organisation called "DMSA Infofilter", maintaining a database of people who did not want to be called by tele-marketeers or be sent commercial email. The marketing companies could query that database given a contact detail, and it would then tell if it was listed. All fine, until that organisation went bankrupt in 2002. Next thing: the trustee handling the bankruptcy tried to sell that database to whoever made the best offer...
    – Arjan
    Commented Oct 11, 2009 at 9:41
  • 3
    See also "Is gravatar a privacy risk?" at meta.stackexchange.com/questions/44717/…
    – Arjan
    Commented Mar 31, 2010 at 17:03
  • 3
    @Arjan ... 8 Years later, it gets upgraded to an official do-not-call registery, with supporting legilation in place. (BTW: Trustee FAIL)
    – alexanderpas
    Commented Dec 12, 2010 at 19:32
  • 3
    @Marc this is in status-deferred for nearly 3 years now - any update?
    – Shadow Wizard
    Commented Jun 19, 2012 at 6:41
  • @ShaDowWizArd little known fact... there actually is a (very limited) way in which this can already be done. However, an important question I would ask you: what genuine problem would this solve?
    – Marc Gravell
    Commented Jun 19, 2012 at 6:51
  • 2
    @Marc no problem and personally I'm totally fine with the gravatar but people keep asking this from time to time and status-deferred means Jeff planned to do that at some point, isn't it? (otherwise, status-declined would have been set back then isn't it?)
    – Shadow Wizard
    Commented Jun 19, 2012 at 7:03
  • 2
    Personally I added Gravatar to my AdBlock Plus list a while ago and forgot StackOverflow had avatars. The service is far too creepy.
    – Boann
    Commented Dec 11, 2012 at 15:49
  • 3
    just found this question while searching some info on gravatars. Seems like the mail info will be sent even if an user doesn't register on gravatar, in which case the "random" generated gravatar is used. This means that I am basically registered by default, only think changing is that with an "official" registration I can change the img, right?... wish we would store the image here, and forget gravatar. At last it seems that this question continue to pop-up, based on the dupe count.
    – SPArcheon - on strike
    Commented Jan 8, 2013 at 16:08
  • 3
    @SPArchaeologist funny timing, few hours after your comment it was rolled out network wide, and the avatars are now automatically hosted on the i.stack.imgur.com account. :)
    – Shadow Wizard
    Commented Jan 10, 2013 at 13:20
  • As an aside, if one does not have a Gravatar account then email addresses for new users and those who click "Change image" are now salted before the MD5 hash is calculated.
    – Arjan
    Commented Dec 21, 2013 at 14:31
  • have you ever setup your own openid server?
    – cregox
    Commented Oct 3, 2020 at 1:34

16 Answers 16

Reset to default
55

it would be nice to have option to point to other avatar using URL, it doesn't have to be hosted by SO-family sites.

Improve this answer
11
  • yep, either uploading an avatar or using an existing image URL would be good.
    – cas
    Commented Jul 13, 2009 at 1:38
  • 5
    There's already a protocol, Pavatar, for doing exactly that without even telling SO about it specifically.
    – bignose
    Commented Jul 13, 2009 at 6:16
  • 6
    Funny that this is the accepted answer -- any other URL could also yield possible web bugs?
    – Arjan
    Commented Jul 17, 2009 at 13:49
  • 9
    yes, but (from the member's/subscriber's POV) if you control the URL, you control who gets to track your membership and identity...and if you host your own avatar URL that means you. also, from the random user's POV, decentralising the web bugs across many sites makes it harder for any one privacy-infringing entity to get the whole story.
    – cas
    Commented Jul 18, 2009 at 2:07
  • 4
    I'm sure you understand the whole picture, but to be very clear for other readers: it would not only be me who can enter a custom URL... I know, one will not see the avatar of a specific other member on each page. But when allowing custom URLs then other members can track IP addresses for specific pages on which their avatar is shown (they could already do that by including images in their answers; the avatar issue also applies to other third-party images). At least it's easy to block gravatar.com -- I wonder how many different avatar sites people would choose when allowing custom URLs.
    – Arjan
    Commented Jul 18, 2009 at 8:39
  • Very good remark! Why making it more difficult than it needs to be?
    – Dimitri C.
    Commented Sep 2, 2009 at 12:42
  • 6
    Sorry, I don't want people posting their own URL. It will affect page performance significantly if I have to load a bunch of huge images from slow sites. Just look at the "what is your favorite web comic" page and see how long it takes--and those are all hotlinked to reasonably fast sites. If a URL is allowed, SO should fetch the URL, resize it appropriately, and store a local copy.
    – Kip
    Commented Jan 22, 2010 at 14:09
  • Good points @Arjan.
    – Pekka
    Commented Feb 10, 2010 at 11:08
  • @Kip, as an aside: as most browsers limit the number of concurrent connections to each server, getting many small images from many slow servers in parallel might be faster than getting all small images from a single fast server... yuiblog.com/blog/2007/04/11/performance-research-part-4 :-) (But then: allowing just any URL gives no control over the file size of the images, so your point is very valid indeed.)
    – Arjan
    Commented Feb 10, 2010 at 11:42
  • @Arjan you're forgetting the caching. if a user already has the gravatar in it's cache (because it was on another site) there is no connection to be made.
    – alexanderpas
    Commented Dec 12, 2010 at 19:20
  • @alexanderpas, I know. But note that gravatar.com sets caching to only 5 minutes. That's not every page load, but every site visit is surely resulting in a call... And surely, bad avatar sites (or private URLs) could disable cache altogether -- just like I did in the web bug in my answer below...
    – Arjan
    Commented Dec 12, 2010 at 19:36
95

Whatever options for avatars are ever implemented, I'd vote against anything allowing animated stuff.


(source: free-avatars.com)

Some do want animated avatars, but I wonder if the added value for those makes up for what I feel is annoying and often looks quite unprofessional, and would make Stack Overflow et al be more like a forum. Of course, some browsers can be set to not animate such images, but then it would no longer animate any image.

When just allowing any URL, how can one control this? Happily, Gravatar seems to agree:

It was a conscious choice not to accept animated images. On the whole most people don’t like them, and it can seriously detract from the look and feel of a site. Since we (all) are guests on peoples web pages we do our best to play nice with the other kids while we are there.

(Thanks, GmonC!)

(I know the above image hurts people's head. But that's the point. Just to ensure the Stack Overflow team doesn't forget it when changing things! And it's not even on every page yet... This could have been a comment to Andrija's answer which suggests just allowing any URL. But an "answer" by itself stands out a bit more, and it's quite important for me.)

Improve this answer
2
  • 17
    Where is my super upvote?
    – Ladybug Killer
    Commented Nov 18, 2009 at 9:30
  • So when can set an avatar of my choosing for my network profile? I'm having trouble finding it at the moment.
    – AppAraat
    Commented Nov 27, 2015 at 10:01
51

In fact I truly dislike avatars from just any third-party site. If I was allowed to put up just any URL as my avatar, then I could very easily track IP addresses of people who've visited any questions that I answered. Likewise, any third-party avatar site knows exactly which visitors share interests.

To extend on Craig's web bug in some very suspicious way (at the moment, I personally do not have a lot of problems with this, but I don't see any advantages either, so allow me to think about some worst case scenario):

  • The third-party avatar sites could keep track of the IP addresses used to visit sites that include those avatars. (When caching is disabled then each page that shows any avatar, not necessarily my avatar, yields a record of my IP address and the page I visited.)
  • For well-known sites, avatar sites could easily recognise profile URLs in the REFERER header, and hence match profiles to hashed email addresses, and (for a limited time) match IP addresses to hashed email addresses. (If a site would show only my avatar on some home page, or would show my avatar with different size or other URL parameters, then this would even be true without actually viewing my own profile.)
  • Easy data mining will reveal static IP addresses. This also makes it easy to couple otherwise non-related hashed email addresses.
  • If I actually subscribe to the avatar site, then it will at least know how to match the hashed email address to the real address. (And it might have some better insight in static IP addresses.)
  • It's very easy to create some Greasemonkey script to alert one if a specific avatar hash is used on any page one is viewing, hence giving homebrew Sherlocks some means to track people across well-known sites. Using wget-like software makes this even easier (or maybe there's some badly-behaving search engine out there that allows for searching on those hashes).
  • Really, one never knows if one day a site owner is forced to give the logs (including things that have been deleted long ago) to some government agency.
  • Given the display name and the avatar hash, one might validate if a guessed email address is correct. (See Gravatars: why publishing your email's hash is not a good idea.)
  • And kind of a side note: even when I want to use an avatar site, it does not really warn me about using a dedicated email address. So, if some site decides to support avatars years after I left my email address on that site, then years later my avatar could show up on a site that I have long forgotten about.

The easiest way to prevent the tracking, is blocking well-known avatar sites (like by adding them to Adblock, or to some tailored hosts file).

If just any URL was to be allowed then blocking will be a lot more difficult. But is does come with some advantages: any tracking by a member (which could, of course, actually be a large advertising firm) using a custom URL will only work for pages that show the avatar of that specific member. That makes it much harder (if possible) to match other avatars to profile pages or IP addresses. I can then also choose to use a custom URL myself, stopping tracking by some third-party avatar site.

(In short: I'd prefer the avatars to be hosted on the SO servers. When not doable, then I'd prefer to keep using this well-known gravatar.com site which I can easily block. It feels a bit selfish though that other members may not be aware of the possible issues.)

Improve this answer
7
  • 1
    Your clock seems to be about four minutes fast.
    – Ether
    Commented Nov 8, 2009 at 22:39
  • 8
    +1 for showing my ip address in your answer!
    – Daniel Vassallo
    Commented Apr 26, 2010 at 6:39
  • 1
    I rather have a single company that is under close scrutiny tracking me than 50000 different individuals.
    – alexanderpas
    Commented Dec 12, 2010 at 19:53
  • 2
    Libravatar is a federated alternative to gravatar. It is lovely because you can host your avatar yourself, and a central server is not even asked if you do that.
    – cweiske
    Commented Aug 4, 2012 at 18:26
  • 1
    But self-hosting one's avatar, @cweiske, would allow me to track your visits to pages on which I posted something too? (Still, nice, I never heard of Libravatar.)
    – Arjan
    Commented Aug 4, 2012 at 18:59
  • 2
    It would indeed. But to get a big picture of me, you'd have to be everywhere on the internet :)
    – cweiske
    Commented Aug 4, 2012 at 20:06
  • do you still think anonymity is so crucial? because most of the web seem to do, but you might have been ahead of this curve back then... and i obviously believe it is not. sooner or later this "privacy bubble" will be popped.
    – cregox
    Commented Oct 3, 2020 at 1:38
20

I second this feature request. To quote from Gravatars terms of service:

More specifically, you hereby do and shall grant to Automattic a worldwide, perpetual, irrevocable, royalty-free and fully-paid, transferable (including rights to sublicense) right to perform the Services (e.g., to use, modify, reproduce, distribute, prepare derivative works of, display, perform, and otherwise fully exercise and exploit all intellectual property, publicity, and moral rights with respect to any User Submissions, and to allow others to do so).

Even if it's just about my profile picture, I don't feel comfortable giving someone irrevocable rights to use it in any way they want (and to transfer these rights to anyone they want).

Improve this answer
2
  • 1
    they just need that for the layers, as they don't have the ability to control what someone else is doing with the profile pictures. I might be displaying them on my blog in black & white.
    – alexanderpas
    Commented Dec 12, 2010 at 19:56
  • 3
    @alexanderpas, citing a legitimate purpose for gathering information does not address the fact that, once gathered, the information can be used for any purpose whether legitimate or not.
    – bignose
    Commented Aug 26, 2016 at 0:19
17

Maintaining an avatar at Gravatar requires that we like and trust that specific site. Maintaining it at this site doesn't scale for all the other sites we visit.

Instead of site-specific solutions, StackOverflow should use an avatar protocol so that each user can choose an avatar hosted at one site of our choice.

By using the open Libravatar service, StackOverflow can let the user choose which service is used for their avatar.

Just as we point StackOverflow to our identity hosted at a site of our choice.

Improve this answer
11

How about just providing a reasonable list of generic picture links - like those you use to make default pics when we open accounts? Info for these links is stored in your DB anyway so just let ppl choose a few without having to go to that gravatar or whatever it is. No one likes to be pushed into yet another account opened somewhere for no rational reason at all, giving e-mail to who know whom or be forced to look at whatever pic you assigned to him. And if people look at a clear reminder of how disrespected they are by whoever runs the site that will destroy a lot of goodwill for you, and make no mistake - a site like this one lives or dies in the long term based on the goodwill it accumulates or looses.

If you really, really, don't want to do anything about this - then just provide the option to turn the pic off - simple enough ?

Improve this answer
2
  • 1
    No one pushes you, though. The avatar is not necessary. You have a pretty generated one.
    – Gnoupi
    Commented Aug 2, 2010 at 12:55
  • 1
    @Gnoupi, you're right as this answer only seems to be about the image itself, not about any privacy concerns. But to overcome such privacy concerns, the option to switch of the avatar, or to select one from a very limited set of SOFU avatars, might be good after all, I guess.
    – Arjan
    Commented Sep 1, 2010 at 11:41
9

Another option would for SO to retrieve the avatar image, and then send it on to the remote user. Add in caching and you disabled the possibility for tracking from the remote site...

Improve this answer
1
  • 4
    Now that SO is providing imgur-based image hosting since August 17, this may very well be possible. Hosting at imgur (which is not only about avatars) reduces many privacy concerns. And users could opt not to have any specific image at al. Sounds good to me! (Unless SO has some special access to imgur to replace existing images, using imgur would imply that the avatar URLs would change when someone uploads a new image through their profile. Sound even better to me!)
    – Arjan
    Commented Sep 25, 2010 at 10:12
5

Add a salt to your email (such as [email protected]) for SO, and Gravatar can't track you on other sites (unless you also use that email elsewhere).

Alternately set up a new email address, or use an anonymous email forwarding service.

Improve this answer
1
5

Doesn't SO already have imgur-hosted image hosting? Why not just restrict users to submitting image links to a trusted site such as that?

Gravatar is very annoying because it only allows you to have separate avatars per email, and I use my same email for many different sites, thus I can't customize my avatar just for SO without affecting all my other accounts on other websites that use Gravatar.

Improve this answer
4

What exactly is the problem with simply being allowed to upload a picture?! Why do we need to use a Gravatar? We already use OpenId (or many do) to sign in, and therefore have been authenticated. I don't get it.

Improve this answer
2
  • Note that most Stack Exchange sites don't need registration to ask or answer. As far as I know, only Stack Overflow and all the Meta sites require one to register.
    – Arjan
    Commented Aug 12, 2012 at 9:39
  • Ok, fine. Then let them use it for those.
    – Cliff Ribaudo
    Commented Aug 12, 2012 at 11:27
2

What I hate about gravatar is their 'nickname' restrictions. There's no good reason for websites to limit names like that (lowercase and numbers only).

Improve this answer
2

I can't even figure out how to use the Gravatar. Gravatar doesn't say how the concept works. Stack Exchange doesn't say either. What am I supposed to do?

Thanks for the downvotes, but there are zero links on gravatar or links from Stack Overflow that say step-by-step how to attach an avatar to your account. Moreover, all the text more or less assumes you already know how all of the OpenID stuff works. This is a big usability gap.

Improve this answer
3
  • 15
    Have you tried offering human sacrifice to The Gravatar? That usually works.
    – alex
    Commented Mar 11, 2010 at 10:13
  • See meta.stackexchange.com/questions/20464/…
    – Arjan
    Commented Mar 11, 2010 at 20:21
  • 2
    basically gravatar is just tied to your email address, sign up there, give it your email, and anywhere you use that email (that uses gravatar) your gravatar will show up. It's simple.. really!
    – Jeff Atwood
    Commented Apr 26, 2010 at 3:43
1

Since announcing the Facebook mini-site in August 2011, people can sort of choose between Gravatar and Facebook images.

When logging in to facebook.stackoverflow.com using Facebook, the Facebook profile picture is used. Once connected, changes to your Facebook profile picture will be reflected on Stack Overflow. It is also used on your flair. One can click "Use Gravatar" in one's profile to stop using the Facebook picture.

Improve this answer
1
  • 2
    And I see only a red flag (generated by RequestPolicy) because I don't allow third party links from any site to Facebook. ;-)
    – celtschk
    Commented Oct 26, 2014 at 10:43
1

Libravatar is a federated alternative for profile images. It is lovely because you can host your avatar yourself, and no central server is contacted if you do that.

It would be especially appropriate for StackOverflow to use Libravatar, because that service can associate a profile image directly to the user's OpenID if they choose.

(This answer originated with a comment from @cweiske.)

Improve this answer
2
  • How is it different from Gravatar and why is it better?
    – Shadow Wizard
    Commented Oct 22, 2014 at 8:40
  • @ShadowWizard: AFAIU it's different because unlike Gravatar, you don't need to pull the avatar from their web site, but can host it locally.
    – celtschk
    Commented Oct 26, 2014 at 10:46
0

As for me - Gravatar does not work at all! I can't change my last gravatar to a new one, I always get 'Whoops! Something went wrong!'. I even can't file a bug, I can either read FAQ or 'ask community for help'. It seems that Gravatar developers are very reluctant to do any technical support.

Therefore, I think Gravatar doesn't deserve to be the only viable alternative in SO.

Improve this answer
3
  • umm... it's not. You can upload images directly to Stack Exchange, no hosting needed anymore
    – Shadow Wizard
    Commented Nov 22, 2015 at 9:28
  • Ah, you're right. SO is fine with that. But SO Careers is gravatar-only :(
    – Mikhail Golubtsov
    Commented Nov 22, 2015 at 9:37
  • True, and there's a pending and planned request for that. (not 100% sure it will be done though, or in the near 10 years, but who knows :))
    – Shadow Wizard
    Commented Nov 22, 2015 at 9:52
-4

lots of people don't have a problem with that, but i do. so i refuse to use gravatar and similar services

Well, that is your choice.

Improve this answer
4
  • 13
    Not really, as the calls to gravatar.com are made anyway, right?
    – Arjan
    Commented Jul 15, 2009 at 14:36
  • 1
    Well, you don't have to provide them with your information.
    – jjnguy
    Commented Jul 15, 2009 at 16:24
  • 8
    True, I don't need to provide information to gravatar.com because, if they want to, they could easily collect that themselves from profiles from the sites that use gravatar.com... It's not a big issue for me personally, but I feel that sites that use gravatar.com should actually warn their users to use unique email addresses (still disregarding issues with static IP addresses) while signing up. :-(
    – Arjan
    Commented Jul 17, 2009 at 12:41
  • 7
    I'm not giving gravatar my information. I'm giving stack exchange my information, and they are passing it on to gravatar. I trust stack exchange. I don't trust gravatar. There is a big difference between a handful of Q&A websites on the internet tracking me, and one that is referenced by half the blogs on the internet. Gravatar can see what sites I visit using the referrer URL for a significant portion of my daily web traffic, and they have my email address and a privacy policy that doesn't allow either to be deleted. I don't like it at all.
    – Abhi Beckert
    Commented Mar 10, 2012 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .