Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I vaguely remember hearing that Gravatar had some security or privacy flaw. I think it was that someone could extract your e-mail address if you used a Gravatar. Is Gravatar safe? How do you know?

Update: There's a similar question about it on Meta Stack Overflow, but I don't understand the discussion well enough to know if I should worry about using Gravatar.

share|improve this question

2 Answers 2

up vote 10 down vote accepted

Speaking personally I've used Gravatar since signing up with Stack Overflow nearly 2 years ago and haven't noticed any problems.

I used a unique e-mail address which is only used for Stack Exchange sites which means that if it was compromised they wouldn't get very far, and if e-mails started turning up from strange sources using that address I'd know it had been hacked.

So far I haven't had any such e-mails.

share|improve this answer
    
Hmm...good idea. Not sure setting up a unique e-mail address would work for me, though. –  Firefeather Dec 3 '10 at 19:45
    
Not really hacked, per se, but more extracted. –  digitxp Dec 3 '10 at 20:03
    
@digitxp - which is why I use a different e-mail for Gravatar to everything else. That way if it is compromised they can't get access to other accounts (Facebook, LinkedIn etc.) because that's not the e-mail I used to sign up to those. –  ChrisF Dec 3 '10 at 20:15
1  
would it be good enough to use a Gmail plus alias (adding + and whatever word you want, just before the @ sign), then? –  Firefeather Dec 15 '10 at 17:36
1  
@Firefeather - probably. I don't use Gmail myself, but to the site where you're signing up it will be a different e-mail address - though if it does get harvested it would be easy to get your base address. –  ChrisF Dec 15 '10 at 17:53

No! Don't give your portrait to Gravatar. Regardless of whether you trust Gravatar Corp, site owners can carelessly betray the identity of users posting under pseudonyms. A cautionary tale:

Hashim in Saudi Arabia secretly reads an American blog about homosexuality. One time, the blog discusses the Middle East, so Hashim comments describing his own experience. He is careful to give a false name 'John Elton' to protect his identity. However the blog software, Wordpress, also demands an email address. The software promises 'your email address will not be published'. Hashim trusts the blog owner and thinks nothing of typing his email address coffeedrinker@gmail.com. There's no risk, his email doesn't even contain his real name

Two years later, Hashim signs up for Stack Overflow under his real name. He gives Gravatar his email and portrait.

Unbeknownst to Hashim , in 2011 Wordpress decided to install Gravatar on their platform, to make it 'more social'. Portraits are added to new comments, but also to millions of archived comments. (Wordpress didn't consider this a privacy issue, because email addresses remain secret). As a consequence, Hashim's face is now publicly displayed next to John Elton's story, but he isn't aware of this.

The secret police happen across the blog post, recognise Hashim from his portrait, and arrest him.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.