Gravatars Can Leak Users' Email Addresses

abell writes "Gravatar offers a global avatar service, using an MD5 hash of the user's email as avatar ID. This piece of information in some cases is enough to retrieve the original email address. Testing a simple attack on stackoverflow.com, I was able to determine the email addresses of more than 10% of the site's users."

Comments

Public address

[AlpineR]

Here's my own Gravatar hash:

b835b33911b93c136d8e61cbbbe6736d

Who will be the first to crack it?

Re:Public address

[Yvan256]

Is it wagnerr@umich.edu?

Re:Public address

[edwebdev]

Here's a Slashdot post that shows my e-mail address next to my username.

Who will be the first to crack it?

Fixed that for you.

Re:Public address

[palegray.net]

I'm certain his email must be umich@wagnerr.edu. Now I just need to figure out why he's attending Wagner of all schools, and how the heck they managed to typo their own domain name.

Re:Public address

[grcumb]

That took all of one second to find in an md5 lookup database. And thirty seconds for me to realize that I could have looked two lines higher to see it in plaintext next to your userid. :wallbash:

Upside: You get to keep your geek card.

Downside: You'll never survive the world outside your basement.

8^)

e9af4cb49c97162d6be3ea8c6ca90a46

[iSzabo]

I actually *just* (20 minutes ago) put my picture up there. Can you guess my email ;)

Re:e9af4cb49c97162d6be3ea8c6ca90a46

[Anonymous Coward]

Your email is: tyler.szabo _AT_ gmail.com

md5 -s "tyler.szabo@gmail.com"

Nice job obfuscating his email in the first line.

Re:So let's change the algorithm.

[Anonymous Coward]

I think you need to stop giving crypto advice for the day, it's not going very well.

In the grand scheme of things this is pretty minor

[Just Brew It!]

It's not exactly big news that a system based on MD5 hashes is susceptible to dictionary-style attacks; this should be obvious to anyone who understands how hashes work. In order for this particular attack to work, the attacker already has to have some reasonable guesses as to what your e-mail address is; the Gravatar trick only confirms the address. So it seems to me that the amount of additional data leaked is fairly small.

OTOH, I suppose I'm somewhat desensitized to this sort of thing, since I've had the same primary e-mail address for something like 15 years (going back to the days when I was rather active on Usenet). My e-mail address is already in every spammer database on the planet, so I don't see how a few more people knowing it could make things any worse!