13

I own my domain and I use different email addresses for different sites, depending on what the site does, whether I think they'll spam me, etc.

Is there a way to tell Gravatar to use a picture for *@example.com unless it's already been defined?

I realize the wildcard would need verification. Gravatar could use the contact information for the domain as a way to validate the request.

2
  • Please give it a whirl and answer your own question. :) Jan 31, 2013 at 1:14
  • I tried, but couldn't make it work. I was hoping there was some way I hadn't thought of. David Schwartz' comment points out a good reason.
    – harleypig
    Jan 31, 2013 at 5:46

1 Answer 1

21

It's impossible. Gravatar doesn't actually operate on email addresses but MD5 hashes of them. There's no way to relate email addresses that have the same portion after the @ sign. If you send Gravatar an email that's not specifically in its database, it has no way to even tell what domain you are asking about.

This is by design to ensure we all know Gravatar isn't collecting email addresses. Otherwise, people would be reluctant to check for a Gravatar -- if the person didn't have one, you'd be giving Gravatar their email address.

11
  • Cool, great answer! Jan 31, 2013 at 1:38
  • 3
    I don't see why they couldn't just have a hashed '@domain.com', and if the address requested doesn't have an explicit email address, just use the fallback. Jul 25, 2014 at 14:18
  • 1
    @DanAtkinson If you can try to guess the domain and full email address separately, many email addresses become guessable. Consider an email like mine -- [email protected]. I doubt you'd get that by brute force. But if you pre-hashed the top few million domains, you'd get the ripple.com part. Then if you tried common first names and last names in combination, you'd get the whole thing. Jul 25, 2014 at 15:26
  • 1
    @DavidSchwartz I'm not sure I understand. Website first sends f6efaf653ca6e67438510cb186250c2c ([email protected]) to gravatar and gets back a 404 or whatever. Then website sends 956b901ef936876db7ba82cebb2cfeb7 (@ripple.com) to gravatar. Gravatar has a match for the domain so sends back the avatar that was set up. How does this expose an email address to them?
    – Gerry
    Jun 6, 2016 at 11:42
  • 3
    This is a bit crazy. If this was really the threat, they could already do this for gmail, hotmail and yahoo to get the vast majority of emails. Also your top million domains crossed with top 10K names is only 10 billion hashes, which can be searched very quickly. Sending the domain first doesn't really help. md5online.org can already search 123 billion hashes. If somebody really wants to reverse most of the emails, they already can.
    – Gerry
    Jun 6, 2016 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.