I own my domain and I use different email addresses for different sites, depending on what the site does, whether I think they'll spam me, etc.

Is there a way to tell Gravatar to use a picture for *@example.com unless it's already been defined?

I realize the wildcard would need verification. Gravatar could use the contact information for the domain as a way to validate the request.

  • Please give it a whirl and answer your own question. :) – James T Snell Jan 31 '13 at 1:14
  • I tried, but couldn't make it work. I was hoping there was some way I hadn't thought of. David Schwartz' comment points out a good reason. – harleypig Jan 31 '13 at 5:46

It's impossible. Gravatar doesn't actually operate on email addresses but MD5 hashes of them. There's no way to relate email addresses that have the same portion after the @ sign. If you send Gravatar an email that's not specifically in its database, it has no way to even tell what domain you are asking about.

This is by design to ensure we all know Gravatar isn't collecting email addresses. Otherwise, people would be reluctant to check for a Gravatar -- if the person didn't have one, you'd be giving Gravatar their email address.

  • Cool, great answer! – Louis Waweru Jan 31 '13 at 1:38
  • 2
    I don't see why they couldn't just have a hashed '@domain.com', and if the address requested doesn't have an explicit email address, just use the fallback. – Dan Atkinson Jul 25 '14 at 14:18
  • 1
    @DanAtkinson If you can try to guess the domain and full email address separately, many email addresses become guessable. Consider an email like mine -- donald@ripple.com. I doubt you'd get that by brute force. But if you pre-hashed the top few million domains, you'd get the ripple.com part. Then if you tried common first names and last names in combination, you'd get the whole thing. – David Schwartz Jul 25 '14 at 15:26
  • 1
    @DavidSchwartz I'm not sure I understand. Website first sends f6efaf653ca6e67438510cb186250c2c (donald@ripple.com) to gravatar and gets back a 404 or whatever. Then website sends 956b901ef936876db7ba82cebb2cfeb7 (@ripple.com) to gravatar. Gravatar has a match for the domain so sends back the avatar that was set up. How does this expose an email address to them? – Gerry Jun 6 '16 at 11:42
  • 3
    This is a bit crazy. If this was really the threat, they could already do this for gmail, hotmail and yahoo to get the vast majority of emails. Also your top million domains crossed with top 10K names is only 10 billion hashes, which can be searched very quickly. Sending the domain first doesn't really help. md5online.org can already search 123 billion hashes. If somebody really wants to reverse most of the emails, they already can. – Gerry Jun 6 '16 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.